CVE-2026-46307
published 2026-06-08CVE-2026-46307: In the Linux kernel, the following vulnerability has been resolved: wifi: ath5k: do not access array OOB Vincent reports: > The ath5k driver seems to do an…
PriorityP342high8.3CVSS 3.1
AVAACLPRNUINSUCHIHAL
EPSS
0.22%
12.5th percentile
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath5k: do not access array OOB
Vincent reports:
> The ath5k driver seems to do an array-index-out-of-bounds access as
> shown by the UBSAN kernel message:
> UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath5k/base.c:1741:20
> index 4 is out of range for type 'ieee80211_tx_rate [4]'
> ...
> Call Trace:
>
> dump_stack_lvl+0x5d/0x80
> ubsan_epilogue+0x5/0x2b
> __ubsan_handle_out_of_bounds.cold+0x46/0x4b
> ath5k_tasklet_tx+0x4e0/0x560 [ath5k]
> tasklet_action_common+0xb5/0x1c0
It is real. 'ts->ts_final_idx' can be 3 on 5212, so:
info->status.rates[ts->ts_final_idx + 1].idx = -1;
with the array defined as:
struct ieee80211_tx_rate rates[IEEE80211_TX_MAX_RATES];
while the size is:
#define IEEE80211_TX_MAX_RATES 4
is indeed bogus.
Set this 'idx = -1' sentinel only if the array index is less than the
array size. As mac80211 will not look at rates beyond the size
(IEEE80211_TX_MAX_RATES).
Note: The effect of the OOB write is negligible. It just overwrites the
next member of info->status, i.e. ack_signal.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 6d7b97b23e114c8fbb825e6721164d228c1af3fc < ecb1c163166759dec004c1fdb9709b8a5992fc8e | ecb1c163166759dec004c1fdb9709b8a5992fc8e |
| linux | linux | >= 6d7b97b23e114c8fbb825e6721164d228c1af3fc < 9dd6aae4bc7bfa11088d928670a3315eae542769 | 9dd6aae4bc7bfa11088d928670a3315eae542769 |
| linux | linux | >= 6d7b97b23e114c8fbb825e6721164d228c1af3fc < 744c19e266b0d2628c5951439195dcef27eadacf | 744c19e266b0d2628c5951439195dcef27eadacf |
| linux | linux | >= 6d7b97b23e114c8fbb825e6721164d228c1af3fc < 83226c71af53fb9b3cad40cb9a9a79f36d68c020 | 83226c71af53fb9b3cad40cb9a9a79f36d68c020 |
| linux | linux | >= 6d7b97b23e114c8fbb825e6721164d228c1af3fc < d6869537013b1f21b292342752d97868b79b5934 | d6869537013b1f21b292342752d97868b79b5934 |
| linux | linux | >= 6d7b97b23e114c8fbb825e6721164d228c1af3fc < e9f1081bc775146156def0dbc821b92f35d56afb | e9f1081bc775146156def0dbc821b92f35d56afb |
| linux | linux | >= 6d7b97b23e114c8fbb825e6721164d228c1af3fc < 568173ad9bd0b46cc6cd937dea8791e9b5eefa57 | 568173ad9bd0b46cc6cd937dea8791e9b5eefa57 |
| linux | linux | >= 6d7b97b23e114c8fbb825e6721164d228c1af3fc < d748603f12baff112caa3ab7d39f50100f010dbd | d748603f12baff112caa3ab7d39f50100f010dbd |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 3.0 < 5.10.258 | 5.10.258 |
| linux | linux_kernel | >= 5.11 < 5.15.209 | 5.15.209 |
| linux | linux_kernel | >= 5.16 < 6.1.175 | 6.1.175 |
| linux | linux_kernel | >= 6.13 < 6.18.30 | 6.18.30 |
| linux | linux_kernel | >= 6.19 < 7.0.7 | 7.0.7 |
| linux | linux_kernel | >= 6.2 < 6.6.140 | 6.6.140 |
| linux | linux_kernel | >= 6.7 < 6.12.88 | 6.12.88 |
CVSS provenance
nvdv3.18.3HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
In the Linux kernel, the following vulnerability has been resolved: wifi: ath5k: do not access array OOB Vincent reports: > The ath5k driver seems to do an array-index-out-of-bounds access as > show
ghsa_unreviewed·2026-06-08
CVE-2026-46307 In the Linux kernel, the following vulnerability has been resolved: wifi: ath5k: do not access array OOB Vincent reports: > The ath5k driver seems to do an array-index-out-of-bounds access as > show
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath5k: do not access array OOB
Vincent reports:
> The ath5k driver seems to do an array-index-out-of-bounds access as
> shown by the UBSAN kernel message:
> UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath5k/base.c:1741:20
> index 4 is out of range for type 'ieee80211_tx_rate [4]'
> ...
> Call Trace:
>
> dump_stack_lvl+0x5d/0x80
> ubsan_epilogue+0x5/0x2b
> __ubsan_handle_out_of_bounds.cold+0x46/0x4b
> ath5k_tasklet_tx+0x4e0/0x560 [ath5k]
> tasklet_action_common+0xb5/0x1c0
It is real. 'ts->ts_final_idx' can be 3 on 5212, so:
info->status.rates[ts->ts_final_idx + 1].idx = -1;
with the array defined as:
struct ieee80211_tx_rate rates[IEEE80211_TX_MAX_RATES];
while the size is:
#define IEEE80211_TX_MAX
VulDB
Linux Kernel up to 7.1-rc2 wifi base.c __ubsan_handle_out_of_bounds.cold+0x46/0x4b ts_final_idx out-of-bounds write
vuldb·2026-06-08
CVE-2026-46307 [CRITICAL] Linux Kernel up to 7.1-rc2 wifi base.c __ubsan_handle_out_of_bounds.cold+0x46/0x4b ts_final_idx out-of-bounds write
A vulnerability, which was classified as critical, has been found in Linux Kernel up to 7.1-rc2. The affected element is the function __ubsan_handle_out_of_bounds.cold+0x46/0x4b of the file drivers/net/wireless/ath/ath5k/base.c of the component wifi. This manipulation of the argument ts_final_idx causes out-of-bounds write.
This vulnerability is registered as CVE-2026-46307. The attack requires access to the local network. No exploit is available.
It is advisable to upgrade the affected component.
Red Hat
kernel: wifi: ath5k: do not access array OOB
vendor_redhat·2026-06-08·CVSS 5.5
CVE-2026-46307 [MEDIUM] CWE-787 kernel: wifi: ath5k: do not access array OOB
kernel: wifi: ath5k: do not access array OOB
A flaw was found in the Linux kernel's ath5k Wi-Fi driver. This vulnerability allows for an array-index-out-of-bounds write in the `ath5k_tasklet_tx` function. An attacker could potentially trigger this by manipulating specific index values, leading to a minor data corruption. The immediate impact of this out-of-bounds write is considered negligible, affecting only the `ack_signal` member of the `info->status` structure.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Out of support scope
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: ke
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/568173ad9bd0b46cc6cd937dea8791e9b5eefa57https://git.kernel.org/stable/c/744c19e266b0d2628c5951439195dcef27eadacfhttps://git.kernel.org/stable/c/83226c71af53fb9b3cad40cb9a9a79f36d68c020https://git.kernel.org/stable/c/9dd6aae4bc7bfa11088d928670a3315eae542769https://git.kernel.org/stable/c/d6869537013b1f21b292342752d97868b79b5934https://git.kernel.org/stable/c/d748603f12baff112caa3ab7d39f50100f010dbdhttps://git.kernel.org/stable/c/e9f1081bc775146156def0dbc821b92f35d56afbhttps://git.kernel.org/stable/c/ecb1c163166759dec004c1fdb9709b8a5992fc8e
2026-06-08
Published