CVE-2026-74408

Received Received - Intake

Out-of-Bounds Access in Linux Kernel ath9k WiFi Driver

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: fix OOB access from firmware tx status queue ID ath_tx_edma_tasklet() accesses sc->tx.txq[ts.qid] where ts.qid is a 4-bit hardware field (0-15), but the txq array only has ATH9K_NUM_TX_QUEUES (10) entries. A qid >= 10 causes an OOB array access. Add a bounds check on ts.qid before using it as an array index.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74408

EUVD

EUVD-2026-59555

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in the Linux kernel's ath9k Wi-Fi driver. It involves an out-of-bounds (OOB) memory access in the function ath_tx_edma_tasklet(). The issue occurs when the driver processes firmware transmission status queue IDs. The hardware field for queue IDs is 4-bit (0-15), but the driver's txq array only has 10 entries. When a queue ID >= 10 is used, it causes an OOB array access, potentially leading to memory corruption or crashes.

Detection Guidance

This vulnerability involves an out-of-bounds (OOB) access in the ath9k WiFi driver of the Linux kernel. Detection requires checking if your system uses the affected ath9k driver and kernel version. Inspect loaded kernel modules with lsmod | grep ath9k and check kernel version with uname -r. If the driver is loaded and the kernel is vulnerable, monitor for crashes or unusual behavior in WiFi operations.

Impact Analysis

This vulnerability could allow an attacker within Wi-Fi range to cause a denial-of-service (DoS) condition on affected systems by triggering the OOB access. This might result in system crashes, freezes, or instability. If exploited, it could also potentially lead to arbitrary code execution, though this would require more complex conditions.

Compliance Impact

This vulnerability is a low-level kernel memory corruption issue in the Linux WiFi driver (ath9k) that could lead to out-of-bounds memory access. It does not directly impact compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy controls rather than low-level driver security flaws.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version that includes the fix for this OOB access issue. Check your distribution's security updates and apply them. If updating is not immediately possible, consider disabling the ath9k driver if WiFi functionality is not critical, using modprobe -r ath9k.

Hi! I’m here to help you understand CVE-2026-74408. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70