Executive brief
A vulnerability exists in the Linux kernel's driver for TI wl1251 Wi-Fi chips. An attacker within Wi-Fi range could potentially cause a system crash or execute unauthorized code by sending malicious data that exploits how the driver handles wireless network packets. This could lead to a complete loss of system availability or compromise of sensitive data on the affected device.
Technical details
A vulnerability in the wl1251 Wi-Fi driver's tx.c component arises from improper validation of firmware completion IDs. The function wl1251_tx_packet_cb() uses a raw u8 ID from a completion block to index the fixed 16-entry wl->tx_frames[] array without bounds checking. An attacker capable of influencing the firmware completion data (typically via adjacent network access) can trigger an out-of-bounds read/write or a NULL pointer dereference (CWE-476). This can result in a kernel panic (DoS) or potentially arbitrary code execution. Patches have been released across multiple stable kernel branches to validate that the ID fits within the array bounds before dereferencing.
Affected products
- Linux Linux Kernel 2.6.31 to 6.6.136, 6.7 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0-rc1 to 7.0-rc6
Timeline
- 2026-03-23: other: Patch submitted by developer
- 2026-05-06: advisory: CVE published by kernel.org
- 2026-05-06: disclosed
- 2026-06-01: patched: Final stable tree updates completed
References
- https://git.kernel.org/stable/c/0fd56fad9c56356e7fa7a7c52e7ecbf807a44eb0
- https://git.kernel.org/stable/c/26ee518695c484f75e3606d631278e84bd24ae02
- https://git.kernel.org/stable/c/6509dbece7339dbc8980c706b9d623119a6de105
- https://git.kernel.org/stable/c/8d7465be5163a923ee5d7459719ef5a021c1584a
- https://git.kernel.org/stable/c/a8a11a876f0a97061ee5d9e61d0f5a0df7e241c7
- https://git.kernel.org/stable/c/b6ba1eacf276063ebeefbbae8056043c24f2efaf
- https://git.kernel.org/stable/c/df15adc692a802636dd3f258fc7cca8bf7a0ed9a