---
cve: "CVE-2026-46307"
severity: "HIGH"
cvss: 8.3
epss: "22%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-06-08 17:16:49"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-09-12T01:53:18+02:00"
---

# CVE-2026-46307

> 8.3 HIGH

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath5k: do not access array OOB

Vincent reports:
> The ath5k driver seems to do an array-index-out-of-bounds access as
> shown by the UBSAN kernel message:
> UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath5k/base.c:1741:20
> index 4 is out of range for type 'ieee80211_tx_rate [4]'
> ...
> Call Trace:
>  
>  dump_stack_lvl+0x5d/0x80
>  ubsan_epilogue+0x5/0x2b
>  __ubsan_handle_out_of_bounds.cold+0x46/0x4b
>  ath5k_tasklet_tx+0x4e0/0x560 [ath5k]
>  tasklet_action_common+0xb5/0x1c0

It is real. 'ts->ts_final_idx' can be 3 on 5212, so:
   info->status.rates[ts->ts_final_idx + 1].idx = -1;
with the array defined as:
   struct ieee80211_tx_rate rates[IEEE80211_TX_MAX_RATES];
while the size is:
   #define IEEE80211_TX_MAX_RATES  4
is indeed bogus.

Set this 'idx = -1' sentinel only if the array index is less than the
array size. As mac80211 will not look at rates beyond the size
(IEEE80211_TX_MAX_RATES).

Note: The effect of the OOB write is negligible. It just overwrites the
next member of info->status, i.e. ack_signal.

## CVSS-Vektor

```
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Benachbart | warn |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Gering | warn |

## Patch verfügbar (OSV)

- Kernel ≥ 5.10.258
- Kernel ≥ 5.15.209
- Kernel ≥ 6.1.175
- Kernel ≥ 6.6.140
- Kernel ≥ 6.12.88
- Kernel ≥ 6.18.30
- Kernel ≥ 7.0.7

## Referenzen

- <https://git.kernel.org/stable/c/ecb1c163166759dec004c1fdb9709b8a5992fc8e>
- <https://git.kernel.org/stable/c/9dd6aae4bc7bfa11088d928670a3315eae542769>
- <https://git.kernel.org/stable/c/744c19e266b0d2628c5951439195dcef27eadacf>
- <https://git.kernel.org/stable/c/83226c71af53fb9b3cad40cb9a9a79f36d68c020>
- <https://git.kernel.org/stable/c/d6869537013b1f21b292342752d97868b79b5934>
- <https://git.kernel.org/stable/c/e9f1081bc775146156def0dbc821b92f35d56afb>
- <https://git.kernel.org/stable/c/568173ad9bd0b46cc6cd937dea8791e9b5eefa57>
- <https://git.kernel.org/stable/c/d748603f12baff112caa3ab7d39f50100f010dbd>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-46307) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_