CVE-2026-74408

wifi: ath9k: fix OOB access from firmware tx status queue ID

State: Published
Severity: 8.8 High
Published: Aug 15, 2026
Updated: Oct 16, 2026
Reserved: Aug 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath9k: fix OOB access from firmware tx status queue ID

ath_tx_edma_tasklet() accesses sc->tx.txq[ts.qid] where ts.qid is a 4-bit hardware field (0-15), but the txq array only has ATH9K_NUM_TX_QUEUES (10) entries. A qid >= 10 causes an OOB array access.

Add a bounds check on ts.qid before using it as an array index.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	fce041beb03f93c7a771f0b4b6c45bb71ef90901 to before fb11083db9d7d6fb8f98bbba1cbfcf3fb7b4bf54Affected fce041beb03f93c7a771f0b4b6c45bb71ef90901 to before 734db72d55ca578a344dfa33e30145032c074b25Affected fce041beb03f93c7a771f0b4b6c45bb71ef90901 to before f5931d06b45ed402572bfe5832fff15864ef5481Affected fce041beb03f93c7a771f0b4b6c45bb71ef90901 to before 46ca1451f61b598f45cb5259e066d305444d95fcAffected fce041beb03f93c7a771f0b4b6c45bb71ef90901 to before a9e055ac62cb3fcea262d4b687ec73eed82b3379Affected fce041beb03f93c7a771f0b4b6c45bb71ef90901 to before 5435fd3edcb11c7cc4002847c83e9a50b49284dcAffected fce041beb03f93c7a771f0b4b6c45bb71ef90901 to before 336d4c8cd9b1646060ee690c881d465dfc09c6c0Affected fce041beb03f93c7a771f0b4b6c45bb71ef90901 to before 7ce2f118a2389e8f0a64068c6fe7cc7d40639be0Affected
LinuxLinux	3.1Affected before 3.1Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

fce041beb03f93c7a771f0b4b6c45bb71ef90901 to before fb11083db9d7d6fb8f98bbba1cbfcf3fb7b4bf54Affected
fce041beb03f93c7a771f0b4b6c45bb71ef90901 to before 734db72d55ca578a344dfa33e30145032c074b25Affected
fce041beb03f93c7a771f0b4b6c45bb71ef90901 to before f5931d06b45ed402572bfe5832fff15864ef5481Affected
fce041beb03f93c7a771f0b4b6c45bb71ef90901 to before 46ca1451f61b598f45cb5259e066d305444d95fcAffected
fce041beb03f93c7a771f0b4b6c45bb71ef90901 to before a9e055ac62cb3fcea262d4b687ec73eed82b3379Affected
fce041beb03f93c7a771f0b4b6c45bb71ef90901 to before 5435fd3edcb11c7cc4002847c83e9a50b49284dcAffected
fce041beb03f93c7a771f0b4b6c45bb71ef90901 to before 336d4c8cd9b1646060ee690c881d465dfc09c6c0Affected
fce041beb03f93c7a771f0b4b6c45bb71ef90901 to before 7ce2f118a2389e8f0a64068c6fe7cc7d40639be0Affected

LinuxLinux

3.1Affected
before 3.1Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.