CVE-2026-43113
published 2026-05-06CVE-2026-43113: In the Linux kernel, the following vulnerability has been resolved: wifi: wl1251: validate packet IDs before indexing tx_frames wl1251_tx_packet_cb() uses the…
PriorityP345high8.8CVSS 3.1
AVAACLPRNUINSUCHIHAH
EPSS
0.25%
16.0th percentile
In the Linux kernel, the following vulnerability has been resolved:
wifi: wl1251: validate packet IDs before indexing tx_frames
wl1251_tx_packet_cb() uses the firmware completion ID directly to index
the fixed 16-entry wl->tx_frames[] array. The ID is a raw u8 from the
completion block, and the callback does not currently verify that it
fits the array before dereferencing it.
Reject completion IDs that fall outside wl->tx_frames[] and keep the
existing NULL check in the same guard. This keeps the fix local to the
trust boundary and avoids touching the rest of the completion flow.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 2f01a1f58889fbfeb68b1bc1b52e4197f3333490 < 6509dbece7339dbc8980c706b9d623119a6de105 | 6509dbece7339dbc8980c706b9d623119a6de105 |
| linux | linux | >= 2f01a1f58889fbfeb68b1bc1b52e4197f3333490 < a8a11a876f0a97061ee5d9e61d0f5a0df7e241c7 | a8a11a876f0a97061ee5d9e61d0f5a0df7e241c7 |
| linux | linux | >= 2f01a1f58889fbfeb68b1bc1b52e4197f3333490 < e0dc1ad870d6788b049bfe1511ac75b2333a7550 | e0dc1ad870d6788b049bfe1511ac75b2333a7550 |
| linux | linux | >= 2f01a1f58889fbfeb68b1bc1b52e4197f3333490 < b6ba1eacf276063ebeefbbae8056043c24f2efaf | b6ba1eacf276063ebeefbbae8056043c24f2efaf |
| linux | linux | >= 2f01a1f58889fbfeb68b1bc1b52e4197f3333490 < df15adc692a802636dd3f258fc7cca8bf7a0ed9a | df15adc692a802636dd3f258fc7cca8bf7a0ed9a |
| linux | linux | >= 2f01a1f58889fbfeb68b1bc1b52e4197f3333490 < 8d7465be5163a923ee5d7459719ef5a021c1584a | 8d7465be5163a923ee5d7459719ef5a021c1584a |
| linux | linux | >= 2f01a1f58889fbfeb68b1bc1b52e4197f3333490 < 26ee518695c484f75e3606d631278e84bd24ae02 | 26ee518695c484f75e3606d631278e84bd24ae02 |
| linux | linux | >= 2f01a1f58889fbfeb68b1bc1b52e4197f3333490 < 0fd56fad9c56356e7fa7a7c52e7ecbf807a44eb0 | 0fd56fad9c56356e7fa7a7c52e7ecbf807a44eb0 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 2.6.31 < 6.6.136 | 6.6.136 |
| linux | linux_kernel | >= 6.13 < 6.18.24 | 6.18.24 |
| linux | linux_kernel | >= 6.19 < 6.19.14 | 6.19.14 |
| linux | linux_kernel | >= 6.7 < 6.12.83 | 6.12.83 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_oracle9.8CRITICAL
vendor_redhat7.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 6.6.135/6.12.82/6.18.23/6.19.13 wl1251_tx_packet_cb tx_frames null pointer dereference (WID-SEC-2026-1385)
vuldb·2026-06-09·CVSS 8.8
CVE-2026-43113 [HIGH] Linux Kernel up to 6.6.135/6.12.82/6.18.23/6.19.13 wl1251_tx_packet_cb tx_frames null pointer dereference (WID-SEC-2026-1385)
A vulnerability was found in Linux Kernel up to 6.6.135/6.12.82/6.18.23/6.19.13. It has been rated as critical. This affects the function wl1251_tx_packet_cb. Performing a manipulation of the argument tx_frames results in null pointer dereference.
This vulnerability is reported as CVE-2026-43113. The attacker must have access to the local network to execute the attack. No exploit exists.
Upgrading the affected component is advised.
GHSA
GHSA-4c54-jj6j-3j34: In the Linux kernel, the following vulnerability has been resolved:
wifi: wl1251: validate packet IDs before indexing tx_frames
wl1251_tx_packet_cb(
ghsa_unreviewed·2026-05-06
CVE-2026-43113 GHSA-4c54-jj6j-3j34: In the Linux kernel, the following vulnerability has been resolved:
wifi: wl1251: validate packet IDs before indexing tx_frames
wl1251_tx_packet_cb(
In the Linux kernel, the following vulnerability has been resolved:
wifi: wl1251: validate packet IDs before indexing tx_frames
wl1251_tx_packet_cb() uses the firmware completion ID directly to index
the fixed 16-entry wl->tx_frames[] array. The ID is a raw u8 from the
completion block, and the callback does not currently verify that it
fits the array before dereferencing it.
Reject completion IDs that fall outside wl->tx_frames[] and keep the
existing NULL check in the same guard. This keeps the fix local to the
trust boundary and avoids touching the rest of the completion flow.
Red Hat
kernel: wifi: wl1251: validate packet IDs before indexing tx_frames
vendor_redhat·2026-05-06·CVSS 7.0
CVE-2026-43113 [MEDIUM] CWE-1285 kernel: wifi: wl1251: validate packet IDs before indexing tx_frames
kernel: wifi: wl1251: validate packet IDs before indexing tx_frames
A flaw was found in the `wl1251` Wi-Fi driver within the Linux kernel. The `wl1251_tx_packet_cb()` function processes firmware completion IDs without proper validation, allowing an attacker to use a crafted ID to access memory outside of allocated bounds. This out-of-bounds access could lead to memory corruption and potentially a denial of service.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Out of support scope
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 8) - Not affected
Oracle
Oracle Oracle Construction and Engineering Risk Matrix: Reports (iTextPDF) — CVE-2021-43113
vendor_oracle·2026-01-15·CVSS 9.8
CVE-2021-43113 [CRITICAL] Oracle Oracle Construction and Engineering Risk Matrix: Reports (iTextPDF) — CVE-2021-43113
Oracle Oracle Construction and Engineering Risk Matrix: Reports (iTextPDF) vulnerability
CVE: CVE-2021-43113
CVSS: 9.8
Protocol: HTTPS
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2026 (JAN 2026)
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/0fd56fad9c56356e7fa7a7c52e7ecbf807a44eb0https://git.kernel.org/stable/c/26ee518695c484f75e3606d631278e84bd24ae02https://git.kernel.org/stable/c/6509dbece7339dbc8980c706b9d623119a6de105https://git.kernel.org/stable/c/8d7465be5163a923ee5d7459719ef5a021c1584ahttps://git.kernel.org/stable/c/a8a11a876f0a97061ee5d9e61d0f5a0df7e241c7https://git.kernel.org/stable/c/b6ba1eacf276063ebeefbbae8056043c24f2efafhttps://git.kernel.org/stable/c/df15adc692a802636dd3f258fc7cca8bf7a0ed9ahttps://git.kernel.org/stable/c/e0dc1ad870d6788b049bfe1511ac75b2333a7550
2026-05-06
Published