CVE-2026-74408wifi: ath9k: fix OOB access from firmware tx status queue ID
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: fix OOB access from firmware tx status queue ID ath_tx_edma_tasklet() accesses sc->tx.txq[ts.qid] where ts.qid is a 4-bit hardware field (0-15), but the txq array only has ATH9K_NUM_TX_QUEUES (10) entries. A qid >= 10 causes an OOB array access. Add a bounds check on ts.qid before using it as an array index.
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from fce041beb03f93c7a771f0b4b6c45bb71ef90901 before fb11083db9d7d6fb8f98bbba1cbfcf3fb7b4bf54; from fce041beb03f93c7a771f0b4b6c45bb71ef90901 before 734db72d55ca578a344dfa33e30145032c074b25; from fce041beb03f93c7a771f0b4b6c45bb71ef90901 before f5931d06b45ed402572bfe5832fff15864ef5481; from fce041beb03f93c7a771f0b4b6c45bb71ef90901 before 46ca1451f61b598f45cb5259e066d305444d95fc; from fce041beb03f93c7a771f0b4b6c45bb71ef90901 before a9e055ac62cb3fcea262d4b687ec73eed82b3379; from fce041beb03f93c7a771f0b4b6c45bb71ef90901 before 5435fd3edcb11c7cc4002847c83e9a50b49284dc; from fce041beb03f93c7a771f0b4b6c45bb71ef90901 before 336d4c8cd9b1646060ee690c881d465dfc09c6c0; from fce041beb03f93c7a771f0b4b6c45bb71ef90901 before 7ce2f118a2389e8f0a64068c6fe7cc7d40639be0 | CNA record |
References
- https://git.kernel.org/stable/c/fb11083db9d7d6fb8f98bbba1cbfcf3fb7b4bf54
- https://git.kernel.org/stable/c/734db72d55ca578a344dfa33e30145032c074b25
- https://git.kernel.org/stable/c/f5931d06b45ed402572bfe5832fff15864ef5481
- https://git.kernel.org/stable/c/46ca1451f61b598f45cb5259e066d305444d95fc
- https://git.kernel.org/stable/c/a9e055ac62cb3fcea262d4b687ec73eed82b3379
- https://git.kernel.org/stable/c/5435fd3edcb11c7cc4002847c83e9a50b49284dc
- https://git.kernel.org/stable/c/336d4c8cd9b1646060ee690c881d465dfc09c6c0
- https://git.kernel.org/stable/c/7ce2f118a2389e8f0a64068c6fe7cc7d40639be0
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.