CVE-2026-46122: wifi: b43: enforce bounds check on firmware key index in b43_rx()
Published May 28, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
wifi: b43: enforce bounds check on firmware key index in b43rx()
The firmware-controlled key index in b43rx() can exceed the dev->key[] array size (58 entries). The existing B43WARNON is non-enforcing in production builds, allowing an out-of-bounds read.
Make the B43WARNON check enforcing by dropping the frame when the firmware returns an invalid key index.
Affected Software
11 affected componentsFixes available
Linux Linux kernel
Linux Linux kernel>=2.6.24<5.10.258
Linux Linux kernel>=5.11<5.15.209
Linux Linux kernel>=5.16<6.1.175
Linux Linux kernel>=6.2<6.6.140
Linux Linux kernel>=6.7<6.12.88
Linux Linux kernel>=6.13<6.18.30
Linux Linux kernel>=6.19<7.0.7
Linux Linux kernel=7.1-rc1
Linux Linux kernel=7.1-rc2
Microsoft azl3 kernel 6.6.139.1-1<6.6.141.1-1
6.6.141.1-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1
Event History
May 28, 2026
CVE Published
via MITRE·09:35 AM
Data Sourced
via MITRE·09:35 AM
Description
Data Sourced
via NVD·10:16 AM
RemedyDescriptionSeverityWeaknessAffected Software
May 29, 2026
Data Sourced
via Microsoft·08:07 AM
DescriptionSeverityWeaknessAffected Software