CVE-2026-46307: Linux ath5k WiFi Driver Array Out-of-Bounds Write

Technical summary

The ath5k driver contains an out-of-bounds array write in the ath5k_tasklet_tx function (base.c:1741). When processing transmission status, the code attempts to write a sentinel value (-1) to info->status.rates[ts->ts_final_idx + 1].idx without checking if ts->ts_final_idx + 1 exceeds the array bounds. The rates array is defined with IEEE80211_TX_MAX_RATES (4 elements), but ts->ts_final_idx can reach 3 on 5212 chipsets, causing the write to index [4]—one element past the end. This overwrites the adjacent ack_signal field in the info->status structure. The root cause is a missing bounds check before the sentinel assignment.

Business impact

Organizations deploying Linux systems with ath5k-based WiFi adapters face a potential stability and data integrity risk. While the overwrite is narrow, it could lead to unpredictable driver behavior, signal-strength reporting anomalies, or in edge cases, kernel instability. Systems relying on accurate WiFi performance metrics may see corrupted telemetry. The vulnerability is unlikely to enable direct remote code execution but represents a reliability gap that could affect wireless network operations in production environments.

Affected systems

Linux kernel systems equipped with Atheros 5000/5500 series WiFi chipsets using the ath5k driver are affected. This includes older laptops, access points, and embedded devices using these chipsets. The vulnerability is present across multiple Linux kernel versions until patched. Users running modern replacement drivers (like ath9k for newer chipsets) are unaffected.

Exploitability

The vulnerability requires adjacent network access (AV:A per CVSS vector) and no authentication. However, reliable exploitation is non-trivial: an attacker must trigger the specific code path during transmission status handling and induce a ts->ts_final_idx value of 3 on affected hardware. The bug is not listed in CISA's KEV catalog, indicating no known active exploitation in the wild. Opportunistic triggering during normal WiFi traffic is theoretically possible but would not yield high-impact results given the narrow scope of the memory corruption.

Remediation

Apply a Linux kernel update that includes the ath5k bounds-check fix. The patch adds a conditional check to only write the sentinel value when ts->ts_final_idx + 1 remains within array bounds. Verify the specific kernel version carrying this fix against your Linux distribution's advisory. For systems where immediate patching is not feasible, restricting ath5k driver usage or replacing hardware with ath9k-compatible alternatives mitigates the risk.

Patch guidance

Check your Linux distribution's security advisories for a kernel update addressing CVE-2026-46307. The fix is straightforward: the driver will only set the rates[idx].idx sentinel if idx is less than IEEE80211_TX_MAX_RATES. Distributions including Ubuntu, Red Hat, and Debian typically backport such kernel fixes to stable branches. Verify the kernel version shipped in your update includes the ath5k fix before deployment.

Detection guidance

Monitor system logs for UBSAN (Undefined Behavior SANitizer) messages referencing ath5k base.c:1741 or array-index-out-of-bounds warnings from the ath5k module. These messages confirm the vulnerability is being triggered. If UBSAN is not enabled at runtime, detection is difficult without custom kernel instrumentation. Network administrators should review WiFi driver logs for unusual transmission status anomalies or unexpected signal-strength reporting. Enable kernel warnings (CONFIG_UBSAN) in test environments to surface the condition before production deployment.

Why prioritize this

Although rated HIGH (CVSS 8.3), practical risk is moderate due to narrow exploit scope, lack of public exploitation, and limited impact (memory field corruption rather than arbitrary code execution). Prioritize based on hardware prevalence: systems with ath5k chipsets should be patched, but this is not an emergency-level issue. Organizations using modern WiFi hardware are likely unaffected. Coordinate patching with regular kernel maintenance cycles.

Risk score, explained

The CVSS 8.3 HIGH score reflects: (1) adjacent-network attack surface (wireless range), (2) low complexity, (3) no authentication required, (4) integrity and confidentiality impacts from state corruption. The score appropriately captures the severity of an unchecked memory write, though the practical impact is constrained by the narrow overwrite window and lack of active exploitation. The absence from CISA KEV suggests currently managed risk.

Frequently asked questions