CVE-2026-46122

HighCVSS 7.8/10Last modified Oct 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: b43: enforce bounds check on firmware key index in b43_rx()

The firmware-controlled key index in b43_rx() can exceed the dev->key[] array size (58 entries). The existing B43_WARN_ON is non-enforcing in production builds, allowing an out-of-bounds read.

Make the B43_WARN_ON check enforcing by dropping the frame when the firmware returns an invalid key index.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-129

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= e4d6b7951812d98417feb10784e400e253caf633, < 135cb49c9a42a02cceeac7b49ec03e267f7ed6d6; >= e4d6b7951812d98417feb10784e400e253caf633, < 3157ad40b084a8f3932da2641749ab45e99b933e; >= e4d6b7951812d98417feb10784e400e253caf633, < 765709720e6af9a178abc40244a8d1aa39ac4e71; >= e4d6b7951812d98417feb10784e400e253caf633, < c3d7b90dc95020cd9282c4630e402fe224f7644e; >= e4d6b7951812d98417feb10784e400e253caf633, < 1e9e55cf66f0fa4799f4d86ef3aaba8e606b5c14; >= e4d6b7951812d98417feb10784e400e253caf633, < d7029879bafdac2006c67553807d122283dc6cbf; >= e4d6b7951812d98417feb10784e400e253caf633, < 219ba67e69e49681e48c822d6eaafb5def032f34; >= e4d6b7951812d98417feb10784e400e253caf633, < 1f4f78bf8549e6ac4f04fba4176854f3a6e0c332
LinuxLinux2.6.24
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystem< *

References

Timeline

Published
May 28, 2026
Last modified
Oct 15, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-461237.7In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtio_bt: clamp rx length before skb_put virtbt_rx_work() CVE-2026-461247.5In the Linux kernel, the following vulnerability has been resolved: isofs: validate block number from NFS file handle in isofs_export_iget CVE-2026-461258.8In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: remove station if connection prep fails If connection CVE-2026-461265.5In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss()CVE-2026-461275.5In the Linux kernel, the following vulnerability has been resolved: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() CVE-2026-461285.5In the Linux kernel, the following vulnerability has been resolved: ipmi: Check event message buffer response for bad data The event messaCVE-2026-461297.8In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double free in create_space_info() error path When kobject_CVE-2026-46137.3A vulnerability was found in SourceCodester E-Commerce Site 1.0. This vulnerability affects unknown code of the file /products.php. The maniCVE-2026-461307.1In the Linux kernel, the following vulnerability has been resolved: dm-verity-fec: fix reading parity bytes split across blocks (take 3) fCVE-2026-461315.5In the Linux kernel, the following vulnerability has been resolved: KVM: x86: check for nEPT/nNPT in slow flush hypercalls Checking is_gueCVE-2026-461325.5In the Linux kernel, the following vulnerability has been resolved: net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_CVE-2026-461337.5In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Reject unknown opcodes before ICRC processing Even after app
CVE-2026-46122: High severity, CVSS 7.8 | Vulnix