{"id":"CVE-2026-24081","title":"Transient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enabled.","summary":"Transient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enabled.","severity":"high","cvss":7.4,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","cwe":["CWE-126"],"vendor":"qualcomm","product":"ar8035_firmware","affected":["ar8035_firmware","c110100_firmware","cologne_firmware","cq7790_firmware","cq7790m_firmware","wcd9385_firmware","wcd9390_firmware","wcd9395_firmware","wcn3988_firmware","wcn6450_firmware","wcn6650_firmware","wcn6755_firmware","wcn7760_firmware","wcn7860_firmware","wcn7861_firmware","wcn7880_firmware","wcn7881_firmware","wcn8841_firmware","wsa8810_firmware","wsa8815_firmware","wsa8830_firmware","wsa8832_firmware","wsa8835_firmware","wsa8840_firmware","wsa8845_firmware","wsa8845h_firmware","wsa8850_firmware","wsa8850w_firmware","wsa8855c_firmware","x1e80100_firmware","xrv7209_firmware","xrv9209_firmware","cq8725s_firmware","cq8750m_firmware","cq8845s_firmware","fastconnect_6200_firmware","fastconnect_6700_firmware","fastconnect_6900_firmware","fastconnect_7800_firmware","fwa_gen_3_ultra_firmware","fwa_gen_5_elite_firmware","g2_gen_1_firmware","g3x_gen_2_firmware","iq-8275_firmware","iq-9075_firmware","iqx5121_firmware","iqx7181_firmware","kobuk_firmware","mbm715_firmware","milos_firmware","milos_iot_firmware","monaco_iot_firmware","netrani_firmware","orne_firmware","palawan25_firmware","pandeiro_firmware","q-7790_firmware","qca0000_firmware","qca6391_firmware","qca6698aq_firmware","qca8081_firmware","qca8337_firmware","qca8386_firmware","qcc2070_firmware","qcc2073_firmware","qcc2076_firmware","qcc5161_firmware","qcc6705_firmware","qcc710_firmware","qcc711_firmware","qcc7225_firmware","qcf8001_firmware","qcn6224_firmware","qcn6274_firmware","qcn9011_firmware","qcn9012_firmware","qcs6690_firmware","qcs8550_firmware","qfw7114_firmware","qfw7124_firmware","qln1083bd_firmware","qln1086bd_firmware","qmp1000_firmware","qmp2001_firmware","qpa1083bd_firmware","qpa1086bd_firmware","fastconnect_8800_mobile_connectivity_system_firmware","qxm1083_firmware","qxm1086_firmware","qxm1093_firmware","qxm1094_firmware","qxm1095_firmware","qxm1096_firmware","s3_gen_2_sound_platform_firmware","s3_sound_platform_firmware","s5_gen_2_sound_platform_firmware","s5_sound_platform_firmware","sar1165p_firmware","sar2130p_firmware","sc8380xp_firmware"],"published":"2026-09-17","updated":"2026-09-22","sourceUpdated":"2026-09-22T19:29:04.963","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-24081","references":[{"url":"https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2026-bulletin.html","label":"product-security@qualcomm.com"}],"tags":["nvd","cve.org"],"epss":0.001,"epssPercentile":0.00776,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-17T14:34:38.432786Z"},"ingestedAt":"2026-09-17T05:11:38.057Z","slug":"CVE-2026-24081","body":"## Overview\n\nTransient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enabled.\n\n## Affected\n\n- `ar8035_firmware`\n- `c110100_firmware`\n- `cologne_firmware`\n- `cq7790_firmware`\n- `cq7790m_firmware`\n- `wcd9385_firmware`\n- `wcd9390_firmware`\n- `wcd9395_firmware`\n- `wcn3988_firmware`\n- `wcn6450_firmware`\n- `wcn6650_firmware`\n- `wcn6755_firmware`\n- `wcn7760_firmware`\n- `wcn7860_firmware`\n- `wcn7861_firmware`\n- `wcn7880_firmware`\n- `wcn7881_firmware`\n- `wcn8841_firmware`\n- `wsa8810_firmware`\n- `wsa8815_firmware`\n- `wsa8830_firmware`\n- `wsa8832_firmware`\n- `wsa8835_firmware`\n- `wsa8840_firmware`\n- `wsa8845_firmware`\n- `wsa8845h_firmware`\n- `wsa8850_firmware`\n- `wsa8850w_firmware`\n- `wsa8855c_firmware`\n- `x1e80100_firmware`\n- `xrv7209_firmware`\n- `xrv9209_firmware`\n- `cq8725s_firmware`\n- `cq8750m_firmware`\n- `cq8845s_firmware`\n- `fastconnect_6200_firmware`\n- `fastconnect_6700_firmware`\n- `fastconnect_6900_firmware`\n- `fastconnect_7800_firmware`\n- `fwa_gen_3_ultra_firmware`\n- `fwa_gen_5_elite_firmware`\n- `g2_gen_1_firmware`\n- `g3x_gen_2_firmware`\n- `iq-8275_firmware`\n- `iq-9075_firmware`\n- `iqx5121_firmware`\n- `iqx7181_firmware`\n- `kobuk_firmware`\n- `mbm715_firmware`\n- `milos_firmware`\n- `milos_iot_firmware`\n- `monaco_iot_firmware`\n- `netrani_firmware`\n- `orne_firmware`\n- `palawan25_firmware`\n- `pandeiro_firmware`\n- `q-7790_firmware`\n- `qca0000_firmware`\n- `qca6391_firmware`\n- `qca6698aq_firmware`\n- `qca8081_firmware`\n- `qca8337_firmware`\n- `qca8386_firmware`\n- `qcc2070_firmware`\n- `qcc2073_firmware`\n- `qcc2076_firmware`\n- `qcc5161_firmware`\n- `qcc6705_firmware`\n- `qcc710_firmware`\n- `qcc711_firmware`\n- `qcc7225_firmware`\n- `qcf8001_firmware`\n- `qcn6224_firmware`\n- `qcn6274_firmware`\n- `qcn9011_firmware`\n- `qcn9012_firmware`\n- `qcs6690_firmware`\n- `qcs8550_firmware`\n- `qfw7114_firmware`\n- `qfw7124_firmware`\n- `qln1083bd_firmware`\n- `qln1086bd_firmware`\n- `qmp1000_firmware`\n- `qmp2001_firmware`\n- `qpa1083bd_firmware`\n- `qpa1086bd_firmware`\n- `fastconnect_8800_mobile_connectivity_system_firmware`\n- `qxm1083_firmware`\n- `qxm1086_firmware`\n- `qxm1093_firmware`\n- `qxm1094_firmware`\n- `qxm1095_firmware`\n- `qxm1096_firmware`\n- `s3_gen_2_sound_platform_firmware`\n- `s3_sound_platform_firmware`\n- `s5_gen_2_sound_platform_firmware`\n- `s5_sound_platform_firmware`\n- `sar1165p_firmware`\n- `sar2130p_firmware`\n- `sc8380xp_firmware`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":40.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}