Executive brief
A vulnerability in the Linux kernel's Broadcom Wi-Fi driver could allow an attacker to trigger an out-of-bounds memory read. This occurs when the system processes specially crafted wireless frames, potentially leading to the exposure of sensitive kernel information or system instability. The issue affects devices using the b43 wireless driver, commonly found in older Broadcom-based networking hardware.
Technical details
An out-of-bounds read vulnerability exists in the Linux kernel's b43 wireless driver. The root cause is located in the b43_rx() function within drivers/net/wireless/broadcom/b43/xmit.c, where a firmware-controlled key index is used to access the dev->key[] array without enforced bounds checking. While a B43_WARN_ON check existed, it was non-enforcing in production builds, allowing indices to exceed the 58-entry array limit. An attacker within radio range could potentially exploit this by sending malicious frames that cause the firmware to return an invalid index, leading to a kernel memory read. The fix involves making the bounds check mandatory and dropping frames with invalid indices.
Affected products
- Linux Linux Kernel All versions prior to the May 2026 patches
Timeline
- 2026-04-17: other: Patch submitted by researcher
- 2026-05-28: advisory: CVE-2026-46122 published by NVD
- 2026-05-14: patched: Patches merged into various stable kernel branches
References
- https://git.kernel.org/stable/c/1e9e55cf66f0fa4799f4d86ef3aaba8e606b5c14
- https://git.kernel.org/stable/c/1f4f78bf8549e6ac4f04fba4176854f3a6e0c332
- https://git.kernel.org/stable/c/219ba67e69e49681e48c822d6eaafb5def032f34
- https://git.kernel.org/stable/c/c3d7b90dc95020cd9282c4630e402fe224f7644e
- https://git.kernel.org/stable/c/d7029879bafdac2006c67553807d122283dc6cbf