Skip to content
Heist/ feed
High

wifi: ath5k: do not access array OOB

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: wifi: ath5k: do not access array OOB Vincent reports: > The ath5k driver seems to do an array-index-out-of-bounds access as > shown by the UBSAN kernel message: > UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath5k/base.c:1741:20 > index 4 is out of range for type 'ieee80211_tx_rate [4]' > ... > Call Trace: > > dump_stack_lvl+0x5d/0x80 > ubsan_epilogue+0x5/0x2b > __ubsan_handle_out_of_bounds.cold+0x46/0x4b > ath5k_tasklet_tx+0x4e0/0x560 [ath5k] > tasklet_action_common+0xb5/0x1c0 It is real. 'ts->ts_final_idx' can be 3 on 5212, so: info->status.rates[ts->ts_final_idx + 1].idx = -1; with the array defined as: struct ieee80211_tx_rate rates[IEEE80211_TX_MAX_RATES]; while the size is: #define IEEE80211_TX_MAX_RATES 4 is indeed bogus. Set this 'idx = -1' sentinel only if the array index is less than the array size. As mac80211 will not look at rates beyond the size (IEEE80211_TX_MAX_RATES). Note: The effect of the OOB write is negligible. It just overwrites the next member of info->status, i.e. ack_signal.

Announced Source revision 1
Original source ↗

CVE-2026-46307

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-46307

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "6d7b97b23e114c8fbb825e6721164d228c1af3fc",
        "lessThan": "ecb1c163166759dec004c1fdb9709b8a5992fc8e",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "6d7b97b23e114c8fbb825e6721164d228c1af3fc",
        "lessThan": "9dd6aae4bc7bfa11088d928670a3315eae542769",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "6d7b97b23e114c8fbb825e6721164d228c1af3fc",
        "lessThan": "744c19e266b0d2628c5951439195dcef27eadacf",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "6d7b97b23e114c8fbb825e6721164d228c1af3fc",
        "lessThan": "83226c71af53fb9b3cad40cb9a9a79f36d68c020",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "6d7b97b23e114c8fbb825e6721164d228c1af3fc",
        "lessThan": "d6869537013b1f21b292342752d97868b79b5934",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "6d7b97b23e114c8fbb825e6721164d228c1af3fc",
        "lessThan": "e9f1081bc775146156def0dbc821b92f35d56afb",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "6d7b97b23e114c8fbb825e6721164d228c1af3fc",
        "lessThan": "568173ad9bd0b46cc6cd937dea8791e9b5eefa57",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "6d7b97b23e114c8fbb825e6721164d228c1af3fc",
        "lessThan": "d748603f12baff112caa3ab7d39f50100f010dbd",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/net/wireless/ath/ath5k/base.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "3.0"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "3.0",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.10.258",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.209",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.175",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.140",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.88",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.30",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "7.0.7",
        "versionType": "semver",
        "lessThanOrEqual": "7.0.*"
      },
      {
        "status": "unaffected",
        "version": "7.1",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/net/wireless/ath/ath5k/base.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-46307

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#28417 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement