CVE-2026-46307 wifi: ath5k: do not access array OOB
An out-of-bounds write in the ath5k Wi-Fi driver can corrupt adjacent memory, though the impact is described as negligible.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46307?
CVE-2026-46307 is a high-severity memory corruption vulnerability in Linux kernel, published on 8 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath5k: do not access array OOB
Vincent reports: > The ath5k driver seems to do an array-index-out-of-bounds access as > shown by the UBSAN kernel message: > UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath5k/base.c:1741:20 > index 4 is out of range for type 'ieee80211_tx_rate [4]' > ... > Call Trace: > <TASK> > dump_stack_lvl+0x5d/0x80 > ubsan_epilogue+0x5/0x2b > __ubsan_handle_out_of_bounds.cold+0x46/0x4b > ath5k_tasklet_tx+0x4e0/0x560 [ath5k] > tasklet_action_common+0xb5/0x1c0
It is real. 'ts->ts_final_idx' can be 3 on 5212, so: info->status.rates[ts->ts_final_idx + 1].idx = -1; with the array defined as: struct ieee80211_tx_rate rates[IEEE80211_TX_MAX_RATES]; while the size is: #define IEEE80211_TX_MAX_RATES 4 is indeed bogus.
Set this 'idx = -1' sentinel only if the array index is less than the array size. As mac80211 will not look at rates beyond the size (IEEE80211_TX_MAX_RATES).
Note: The effect of the OOB write is negligible. It just overwrites the next member of info->status, i.e. ack_signal.
Weakness: CWE-125
Which versions are affected by CVE-2026-46307?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-46307?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-46307 being exploited?
There is no known exploitation of CVE-2026-46307 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-89595, BELL-CVE-2026-46307, DEBIAN-CVE-2026-46307, GHSA-qrx4-q7hg-2xx2, ROOT-OS-DEBIAN-11-CVE-2026-46307, ROOT-OS-DEBIAN-12-CVE-2026-46307 and 1 more.