CVE-2026-46122

Analyzed Analyzed - Analysis Complete

Buffer Overflow in Linux Kernel WiFi Driver

Publication date: 2026-05-28

Last updated on: 2026-06-24

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: b43: enforce bounds check on firmware key index in b43_rx() The firmware-controlled key index in b43_rx() can exceed the dev->key[] array size (58 entries). The existing B43_WARN_ON is non-enforcing in production builds, allowing an out-of-bounds read. Make the B43_WARN_ON check enforcing by dropping the frame when the firmware returns an invalid key index.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-28

Last Modified

2026-06-24

Generated

2026-07-08

AI Q&A

2026-05-28

EPSS Evaluated

2026-07-06

NVD

CVE-2026-46122

EUVD

EUVD-2026-32881

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.13 (inc) to 6.18.30 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.175 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.209 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.7 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.88 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.140 (exc)
linux	linux_kernel	From 2.6.24 (inc) to 5.10.258 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-129	The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's b43 wireless driver. Specifically, the firmware-controlled key index used in the b43_rx() function can exceed the size of the device's key array, which has 58 entries. The existing warning mechanism (B43_WARN_ON) that detects this out-of-bounds access is not enforced in production builds, allowing an out-of-bounds read to occur. The fix enforces this check by dropping any frame where the firmware returns an invalid key index, preventing the out-of-bounds read.

Impact Analysis

This vulnerability can lead to an out-of-bounds read in the Linux kernel's wireless driver, which may cause unexpected behavior such as crashes or information leakage. Since the key index can exceed the valid range, it might allow the firmware to access memory outside the intended bounds, potentially leading to instability or exposing sensitive data.

Mitigation Strategies

The vulnerability in the Linux kernel's b43 driver involves an out-of-bounds read due to a non-enforcing bounds check on the firmware key index.

To mitigate this vulnerability, update your Linux kernel to a version where the B43_WARN_ON check is made enforcing, which drops frames when the firmware returns an invalid key index.

Hi! I’m here to help you understand CVE-2026-46122. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70