CVE-2026-46307

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath5k: do not access array OOB

Vincent reports:

> The ath5k driver seems to do an array-index-out-of-bounds access as

> shown by the UBSAN kernel message:

> UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath5k/base.c:1741:20

> index 4 is out of range for type 'ieee80211_tx_rate [4]'

> ...

> Call Trace:

> <TASK>

> dump_stack_lvl+0x5d/0x80

> ubsan_epilogue+0x5/0x2b

> __ubsan_handle_out_of_bounds.cold+0x46/0x4b

> ath5k_tasklet_tx+0x4e0/0x560 [ath5k]

> tasklet_action_common+0xb5/0x1c0

It is real. 'ts->ts_final_idx' can be 3 on 5212, so:

info->status.rates[ts->ts_final_idx + 1].idx = -1;

with the array defined as:

struct ieee80211_tx_rate rates[IEEE80211_TX_MAX_RATES];

while the size is:

#define IEEE80211_TX_MAX_RATES 4

is indeed bogus.

Set this 'idx = -1' sentinel only if the array index is less than the

array size. As mac80211 will not look at rates beyond the size

(IEEE80211_TX_MAX

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References