CVE-2026-46307
wifi: ath5k: do not access array OOB
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: ath5k: do not access array OOB Vincent reports: > The ath5k driver seems to do an array-index-out-of-bounds access as > shown by the UBSAN kernel message: > UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath5k/base.c:1741:20 > index 4 is out of range for type 'ieee80211_tx_rate [4]' > ... > Call Trace: > <TASK> > dump_stack_lvl+0x5d/0x80 > ubsan_epilogue+0x5/0x2b > __ubsan_handle_out_of_bounds.cold+0x46/0x4b > ath5k_tasklet_tx+0x4e0/0x560 [ath5k] > tasklet_action_common+0xb5/0x1c0 It is real. 'ts->ts_final_idx' can be 3 on 5212, so: info->status.rates[ts->ts_final_idx + 1].idx = -1; with the array defined as: struct ieee80211_tx_rate rates[IEEE80211_TX_MAX_RATES]; while the size is: #define IEEE80211_TX_MAX_RATES 4 is indeed bogus. Set this 'idx = -1' sentinel only if the array index is less than the array size. As mac80211 will not look at rates beyond the size (IEEE80211_TX_MAX_RATES). Note: The effect of the OOB write is negligible. It just overwrites the next member of info->status, i.e. ack_signal.
INFO
Published Date :
June 8, 2026, 5:16 p.m.
Last Modified :
July 23, 2026, 8:10 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Update the Linux kernel to a patched version.
- Ensure array indices are within bounds.
- Check for writes beyond array size.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-46307.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-46307 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-46307
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-46307 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-46307 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Jul. 23, 2026
Action Type Old Value New Value Added Translation Title: wifi: ath5k: do not access array OOB, Description: En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: wifi: ath5k: no acceder al array OOB Vincent informa: > El controlador ath5k parece realizar un acceso de índice de array fuera de límites como > mostrado por el mensaje del kernel de UBSAN: > UBSAN: índice de array fuera de límites en drivers/net/wireless/ath/ath5k/base.c:1741:20 > el índice 4 está fuera de rango para el tipo 'ieee80211_tx_rate [4]' > ... > Traza de Llamada: > <TAREA> > dump_stack_lvl+0x5d/0x80 > ubsan_epilogue+0x5/0x2b > __ubsan_handle_out_of_bounds.cold+0x46/0x4b > ath5k_tasklet_tx+0x4e0/0x560 [ath5k] > tasklet_action_common+0xb5/0x1c0 Es real. 'ts->ts_final_idx' puede ser 3 en 5212, así que: info->status.rates[ts->ts_final_idx + 1].idx = -1; con el array definido como: struct ieee80211_tx_rate rates[IEEE80211_TX_MAX_RATES]; mientras que el tamaño es: #define IEEE80211_TX_MAX_RATES 4 es de hecho erróneo. Establecer este centinela 'idx = -1' solo si el índice del array es menor que el tamaño del array. Ya que mac80211 no buscará tasas más allá del tamaño (IEEE80211_TX_MAX_RATES). Nota: El efecto de la escritura OOB es insignificante. Simplemente sobrescribe el siguiente miembro de info->status, es decir, ack_signal. -
Initial Analysis by [email protected]
Jul. 08, 2026
Action Type Old Value New Value Added CWE CWE-125 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.30 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.175 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.209 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.7 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.88 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.140 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 3.0 up to (excluding) 5.10.258 Added Reference Type kernel.org: https://git.kernel.org/stable/c/568173ad9bd0b46cc6cd937dea8791e9b5eefa57 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/744c19e266b0d2628c5951439195dcef27eadacf Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/83226c71af53fb9b3cad40cb9a9a79f36d68c020 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/9dd6aae4bc7bfa11088d928670a3315eae542769 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/d6869537013b1f21b292342752d97868b79b5934 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/d748603f12baff112caa3ab7d39f50100f010dbd Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/e9f1081bc775146156def0dbc821b92f35d56afb Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/ecb1c163166759dec004c1fdb9709b8a5992fc8e Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6d7b97b23e114c8fbb825e6721164d228c1af3fc', 'lessThan': 'ecb1c163166759dec004c1fdb9709b8a5992fc8e', 'versionType': 'git'}, {'status': 'affected', 'version': '6d7b97b23e114c8fbb825e6721164d228c1af3fc', 'lessThan': '9dd6aae4bc7bfa11088d928670a3315eae542769', 'versionType': 'git'}, {'status': 'affected', 'version': '6d7b97b23e114c8fbb825e6721164d228c1af3fc', 'lessThan': '744c19e266b0d2628c5951439195dcef27eadacf', 'versionType': 'git'}, {'status': 'affected', 'version': '6d7b97b23e114c8fbb825e6721164d228c1af3fc', 'lessThan': '83226c71af53fb9b3cad40cb9a9a79f36d68c020', 'versionType': 'git'}, {'status': 'affected', 'version': '6d7b97b23e114c8fbb825e6721164d228c1af3fc', 'lessThan': 'd6869537013b1f21b292342752d97868b79b5934', 'versionType': 'git'}, {'status': 'affected', 'version': '6d7b97b23e114c8fbb825e6721164d228c1af3fc', 'lessThan': 'e9f1081bc775146156def0dbc821b92f35d56afb', 'versionType': 'git'}, {'status': 'affected', 'version': '6d7b97b23e114c8fbb825e6721164d228c1af3fc', 'lessThan': '568173ad9bd0b46cc6cd937dea8791e9b5eefa57', 'versionType': 'git'}, {'status': 'affected', 'version': '6d7b97b23e114c8fbb825e6721164d228c1af3fc', 'lessThan': 'd748603f12baff112caa3ab7d39f50100f010dbd', 'versionType': 'git'}], 'programFiles': ['drivers/net/wireless/ath/ath5k/base.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.0'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.0', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.258', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.209', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.175', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.140', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.88', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.30', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.7', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/net/wireless/ath/ath5k/base.c'], 'defaultStatus': 'affected'}] -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 14, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 08, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: wifi: ath5k: do not access array OOB Vincent reports: > The ath5k driver seems to do an array-index-out-of-bounds access as > shown by the UBSAN kernel message: > UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath5k/base.c:1741:20 > index 4 is out of range for type 'ieee80211_tx_rate [4]' > ... > Call Trace: > <TASK> > dump_stack_lvl+0x5d/0x80 > ubsan_epilogue+0x5/0x2b > __ubsan_handle_out_of_bounds.cold+0x46/0x4b > ath5k_tasklet_tx+0x4e0/0x560 [ath5k] > tasklet_action_common+0xb5/0x1c0 It is real. 'ts->ts_final_idx' can be 3 on 5212, so: info->status.rates[ts->ts_final_idx + 1].idx = -1; with the array defined as: struct ieee80211_tx_rate rates[IEEE80211_TX_MAX_RATES]; while the size is: #define IEEE80211_TX_MAX_RATES 4 is indeed bogus. Set this 'idx = -1' sentinel only if the array index is less than the array size. As mac80211 will not look at rates beyond the size (IEEE80211_TX_MAX_RATES). Note: The effect of the OOB write is negligible. It just overwrites the next member of info->status, i.e. ack_signal. Added Reference https://git.kernel.org/stable/c/568173ad9bd0b46cc6cd937dea8791e9b5eefa57 Added Reference https://git.kernel.org/stable/c/744c19e266b0d2628c5951439195dcef27eadacf Added Reference https://git.kernel.org/stable/c/83226c71af53fb9b3cad40cb9a9a79f36d68c020 Added Reference https://git.kernel.org/stable/c/9dd6aae4bc7bfa11088d928670a3315eae542769 Added Reference https://git.kernel.org/stable/c/d6869537013b1f21b292342752d97868b79b5934 Added Reference https://git.kernel.org/stable/c/d748603f12baff112caa3ab7d39f50100f010dbd Added Reference https://git.kernel.org/stable/c/e9f1081bc775146156def0dbc821b92f35d56afb Added Reference https://git.kernel.org/stable/c/ecb1c163166759dec004c1fdb9709b8a5992fc8e