Executive brief
A vulnerability in the Linux kernel's driver for older Broadcom Wi-Fi cards could allow a malicious actor to trigger an out-of-bounds memory read. This occurs when the system processes specially crafted wireless frames, potentially leading to system instability or the exposure of sensitive kernel information. The issue affects legacy hardware using the b43legacy driver.
Technical details
An out-of-bounds read vulnerability exists in the b43legacy_rx() function within the Linux kernel's b43legacy wireless driver. The root cause is a failure to enforce bounds checking on the 'keyidx' variable, which is derived from firmware-controlled data, before using it to index the 'dev->key[]' array. While a warning macro (B43legacy_WARN_ON) existed, it was non-enforcing in production builds. An attacker within radio range could potentially exploit this by sending malicious frames that cause the driver to read beyond the allocated memory for keys. The fix implements an explicit check that drops the frame if the index exceeds 'dev->max_nr_keys'.
Affected products
- Linux Linux Kernel All versions prior to the May 2026 patches
Timeline
- 2026-04-17: other: Patch submitted by Tristan Madani
- 2026-05-28: disclosed: CVE published and patches merged into stable trees
References
- https://git.kernel.org/stable/c/1baaeb6adecb9691748c0253dab6ddd19a2b4e9e
- https://git.kernel.org/stable/c/6ee946077607d7783ae6709a899213fc4fe08f35
- https://git.kernel.org/stable/c/9d1bc155802943e92c57a5fb923d23edfbf0b525
- https://git.kernel.org/stable/c/a035766f970bde2d4298346a31a80685be5c0205
- https://git.kernel.org/stable/c/fdd4e51979f42ca8b1ab7e6176b607e1caabf2a5