CVE-2026-46163: wifi: b43legacy: enforce bounds check on firmware key index in RX path
In the Linux kernel, the following vulnerability has been resolved:
wifi: b43legacy: enforce bounds check on firmware key index in RX path
Same fix as b43: the firmware-controlled key index in b43legacyrx() can exceed dev->maxnrkeys. The existing B43legacyWARNON is non-enforcing in production builds, allowing an out-of-bounds read of dev->key[].
Make the check enforcing by dropping the frame for invalid indices.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1
Event History
Frequently Asked Questions
What level of access does an attacker need?
The CVSS vector indicates local access and low privileges are required. No user interaction is required.
Which systems should be prioritized for remediation?
Prioritize Linux kernel deployments using b43legacy, including the listed Microsoft azl3 kernel 6.6.139.1-1. The affected RX path can use a firmware-controlled key index beyond the key array bounds.
What is the effect of the fix?
The fix makes the key-index validation enforcing: frames with invalid indices are dropped. Previously, the production-build warning did not prevent the out-of-bounds read.