CVE-2026-74340

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:AAttack vector, adjacent network

The bug is reached when WCN3660/3680 firmware delivers a PRINT_REG_INFO_IND over the WLAN_CTRL rpmsg channel; crafted 802.11 traffic in radio range can cause the firmware to emit this malformed indication on Qualcomm Android phones and tablets using wcn36xx.

AC:LAttack complexity, low

An adjacent attacker can repeatedly transmit WiFi frames during background scanning or association to elicit the firmware indication, then set count far above the short rpmsg payload; the driver loop performs deterministic out-of-bounds reads until a fault occurs.

PR:NPrivileges required, none

Exploitation requires no local account or kernel privileges on the victim; only radio proximity to a device with the wcn36xx driver loaded and WiFi active, which is the default state on typical mobile deployments of this chipset.

UI:NUser interaction, none

No specific victim action beyond normal WiFi operation is required; phones continuously scan and associate automatically, allowing an adjacent attacker to trigger the firmware indication passively or via a rogue access point.

S:UScope, unchanged

The out-of-bounds read occurs in kernel heap memory during wcn36xx firmware message handling, enabling standard kernel information disclosure or denial of service rather than crossing a VM, IOMMU, or other separate security authority boundary.

C:HConfidentiality impact, high

The unchecked firmware count allows unbounded out-of-bounds reads from the kmalloc_flex indication buffer into adjacent kernel heap objects; with debug_mask set the leaked register values are printed to the kernel log, and the reads themselves expose sensitive heap contents.

I:NIntegrity impact, none

This is a read-only out-of-bounds access that indexes past the message buffer without writing memory; the loop only reads addr/value pairs for debug logging and does not corrupt heap metadata or provide an arbitrary write primitive.

A:HAvailability impact, high

A firmware-controlled count near UINT_MAX causes the handler to perform massive out-of-bounds reads past the kmalloc allocation, reliably triggering a kernel page fault, oops, or panic and denying all system and wireless availability.