CVE-2026-43113

wifi: wl1251: validate packet IDs before indexing tx_frames

State: Published
Severity: 8.8 High
Published: May 6, 2026
Updated: Aug 5, 2026
Reserved: May 1, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: wl1251: validate packet IDs before indexing tx_frames

wl1251_tx_packet_cb() uses the firmware completion ID directly to index the fixed 16-entry wl->tx_frames[] array. The ID is a raw u8 from the completion block, and the callback does not currently verify that it fits the array before dereferencing it.

Reject completion IDs that fall outside wl->tx_frames[] and keep the existing NULL check in the same guard. This keeps the fix local to the trust boundary and avoids touching the rest of the completion flow.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	2f01a1f58889fbfeb68b1bc1b52e4197f3333490 to before 6509dbece7339dbc8980c706b9d623119a6de105Affected 2f01a1f58889fbfeb68b1bc1b52e4197f3333490 to before a8a11a876f0a97061ee5d9e61d0f5a0df7e241c7Affected 2f01a1f58889fbfeb68b1bc1b52e4197f3333490 to before e0dc1ad870d6788b049bfe1511ac75b2333a7550Affected 2f01a1f58889fbfeb68b1bc1b52e4197f3333490 to before b6ba1eacf276063ebeefbbae8056043c24f2efafAffected 2f01a1f58889fbfeb68b1bc1b52e4197f3333490 to before df15adc692a802636dd3f258fc7cca8bf7a0ed9aAffected 2f01a1f58889fbfeb68b1bc1b52e4197f3333490 to before 8d7465be5163a923ee5d7459719ef5a021c1584aAffected 2f01a1f58889fbfeb68b1bc1b52e4197f3333490 to before 26ee518695c484f75e3606d631278e84bd24ae02Affected 2f01a1f58889fbfeb68b1bc1b52e4197f3333490 to before 0fd56fad9c56356e7fa7a7c52e7ecbf807a44eb0Affected
LinuxLinux	2.6.31Affected before 2.6.31Not affected 5.10.258 through 5.10.Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.136 through 6.6.Not affected 6.12.83 through 6.12.Not affected 6.18.24 through 6.18.Not affected 6.19.14 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

2f01a1f58889fbfeb68b1bc1b52e4197f3333490 to before 6509dbece7339dbc8980c706b9d623119a6de105Affected
2f01a1f58889fbfeb68b1bc1b52e4197f3333490 to before a8a11a876f0a97061ee5d9e61d0f5a0df7e241c7Affected
2f01a1f58889fbfeb68b1bc1b52e4197f3333490 to before e0dc1ad870d6788b049bfe1511ac75b2333a7550Affected
2f01a1f58889fbfeb68b1bc1b52e4197f3333490 to before b6ba1eacf276063ebeefbbae8056043c24f2efafAffected
2f01a1f58889fbfeb68b1bc1b52e4197f3333490 to before df15adc692a802636dd3f258fc7cca8bf7a0ed9aAffected
2f01a1f58889fbfeb68b1bc1b52e4197f3333490 to before 8d7465be5163a923ee5d7459719ef5a021c1584aAffected
2f01a1f58889fbfeb68b1bc1b52e4197f3333490 to before 26ee518695c484f75e3606d631278e84bd24ae02Affected
2f01a1f58889fbfeb68b1bc1b52e4197f3333490 to before 0fd56fad9c56356e7fa7a7c52e7ecbf807a44eb0Affected

LinuxLinux

2.6.31Affected
before 2.6.31Not affected
5.10.258 through 5.10.*Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.136 through 6.6.*Not affected
6.12.83 through 6.12.*Not affected
6.18.24 through 6.18.*Not affected
6.19.14 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.