wifi: ath9k: fix OOB access from firmware tx status queue ID

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-74408
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-08-15 06:22:42 UTC
Updated2026-08-17 06:19:36 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: fix OOB access from firmware tx status queue ID ath_tx_edma_tasklet() accesses sc->tx.txq[ts.qid] where ts.qid is a 4-bit hardware field (0-15), but the txq array only has ATH9K_NUM_TX_QUEUES (10) entries. A qid >= 10 causes an OOB array access. Add a bounds check on ts.qid before using it as an array index.

Risk And Classification

Primary CVSS: v3.1 8.8 HIGH from 416baaa9-dc9f-4396-8d5f-8c081fb06d67

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.002660000 probability, percentile 0.185290000 (date 2026-08-17)

VersionSourceTypeScoreSeverityVector
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary8.8HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.1CNADECLARED8.8HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected fce041beb03f93c7a771f0b4b6c45bb71ef90901 fb11083db9d7d6fb8f98bbba1cbfcf3fb7b4bf54 git Not specified
CNA Linux Linux affected fce041beb03f93c7a771f0b4b6c45bb71ef90901 734db72d55ca578a344dfa33e30145032c074b25 git Not specified
CNA Linux Linux affected fce041beb03f93c7a771f0b4b6c45bb71ef90901 f5931d06b45ed402572bfe5832fff15864ef5481 git Not specified
CNA Linux Linux affected fce041beb03f93c7a771f0b4b6c45bb71ef90901 46ca1451f61b598f45cb5259e066d305444d95fc git Not specified
CNA Linux Linux affected fce041beb03f93c7a771f0b4b6c45bb71ef90901 a9e055ac62cb3fcea262d4b687ec73eed82b3379 git Not specified
CNA Linux Linux affected fce041beb03f93c7a771f0b4b6c45bb71ef90901 5435fd3edcb11c7cc4002847c83e9a50b49284dc git Not specified
CNA Linux Linux affected fce041beb03f93c7a771f0b4b6c45bb71ef90901 336d4c8cd9b1646060ee690c881d465dfc09c6c0 git Not specified
CNA Linux Linux affected fce041beb03f93c7a771f0b4b6c45bb71ef90901 7ce2f118a2389e8f0a64068c6fe7cc7d40639be0 git Not specified
CNA Linux Linux affected 3.1 Not specified
CNA Linux Linux unaffected 3.1 semver Not specified
CNA Linux Linux unaffected 5.10.261 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.212 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.178 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.145 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.97 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.40 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.5 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/46ca1451f61b598f45cb5259e066d305444d95fc 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/734db72d55ca578a344dfa33e30145032c074b25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/fb11083db9d7d6fb8f98bbba1cbfcf3fb7b4bf54 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/f5931d06b45ed402572bfe5832fff15864ef5481 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/5435fd3edcb11c7cc4002847c83e9a50b49284dc 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/7ce2f118a2389e8f0a64068c6fe7cc7d40639be0 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/a9e055ac62cb3fcea262d4b687ec73eed82b3379 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/336d4c8cd9b1646060ee690c881d465dfc09c6c0 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report