CVE-2026-46307: wifi: ath5k: do not access array OOB
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath5k: do not access array OOB
Vincent reports: The ath5k driver seems to do an array-index-out-of-bounds access as shown by the UBSAN kernel message: UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath5k/base.c:1741:20 index 4 is out of range for type 'ieee80211txrate [4]' ... Call Trace: <TASK> dumpstacklvl+0x5d/0x80 ubsanepilogue+0x5/0x2b ubsanhandleoutofbounds.cold+0x46/0x4b ath5ktasklettx+0x4e0/0x560 [ath5k] taskletactioncommon+0xb5/0x1c0
It is real. 'ts->tsfinalidx' can be 3 on 5212, so: info->status.rates[ts->tsfinalidx + 1].idx = -1; with the array defined as: struct ieee80211txrate rates[IEEE80211TXMAXRATES]; while the size is: #define IEEE80211TXMAXRATES 4 is indeed bogus.
Set this 'idx = -1' sentinel only if the array index is less than the array size. As mac80211 will not look at rates beyond the size (IEEE80211TXMAXRATES).
Note: The effect of the OOB write is negligible. It just overwrites the next member of info->status, i.e. acksignal.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1 - Configuration
Fix the array-index-out-of-bounds by only setting the 'idx = -1' sentinel when the computed array index is within bounds: set sentinel at info->status.rates[ts->ts_final_idx + 1].idx = -1 only if (ts->ts_final_idx + 1) is less than the array size of struct ieee80211_tx_rate rates[IEEE80211_TX_MAX_RATES] (IEEE80211_TX_MAX_RATES == 4).
ath5k (Linux kernel: drivers/net/wireless/ath/ath5k) info->status.rates[ts->ts_final_idx + 1].idx sentinel handling = -1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46307?
CVE-2026-46307 has a severity rating of 10, indicating it is critical.
What does CVE-2026-46307 affect?
CVE-2026-46307 affects the ath5k wireless driver in the Linux kernel.
What type of vulnerability is CVE-2026-46307?
CVE-2026-46307 is an array-index-out-of-bounds vulnerability.
How do I fix CVE-2026-46307?
To fix CVE-2026-46307, ensure your Linux kernel and ath5k driver are updated to the latest patched version.
When was CVE-2026-46307 published?
CVE-2026-46307 was published on June 8, 2026.