CVE-2026-46122 wifi: b43: enforce bounds check on firmware key index in b43_rx()
A missing bounds check in the b43 wifi driver allows an out-of-bounds read via a malicious firmware key index, potentially leaking kernel memory.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46122?
CVE-2026-46122 is a high-severity memory corruption vulnerability in Linux kernel, published on 28 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: b43: enforce bounds check on firmware key index in b43_rx()
The firmware-controlled key index in b43_rx() can exceed the dev->key[] array size (58 entries). The existing B43_WARN_ON is non-enforcing in production builds, allowing an out-of-bounds read.
Make the B43_WARN_ON check enforcing by dropping the frame when the firmware returns an invalid key index.
Weakness: CWE-129
Which versions are affected by CVE-2026-46122?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-46122?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-46122 being exploited?
There is no known exploitation of CVE-2026-46122 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-88896, BELL-CVE-2026-46122, DEBIAN-CVE-2026-46122, GHSA-pq22-w363-wp5p, ROOT-OS-DEBIAN-11-CVE-2026-46122, ROOT-OS-DEBIAN-12-CVE-2026-46122 and 3 more.