PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46122 Linux CVE debrief

A bounds-checking vulnerability in the Linux kernel's b43 wireless driver allows out-of-bounds memory access when processing received frames. The b43_rx() function accepts a firmware-controlled key index without enforcing array bounds against the 58-entry dev->key[] array. The existing B43_WARN_ON() macro is non-enforcing in production builds, permitting out-of-bounds reads. The fix converts this warning into an enforced check that drops frames with invalid key indices.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-24
Advisory published
2026-05-28
Advisory updated
2026-06-24

Who should care

Organizations running Linux systems with Broadcom 43xx wireless hardware; kernel maintainers and distributors packaging b43 driver; security teams tracking Linux kernel wireless subsystem vulnerabilities

Technical summary

The b43_rx() function in drivers/net/wireless/broadcom/b43/main.c processes received 802.11 frames using a key index provided by firmware. The dev->key[] array is fixed at 58 entries (B43_NR_KEYS). The existing B43_WARN_ON(index >= B43_NR_KEYS) check uses WARN_ON which compiles to a no-op in production builds when CONFIG_BUG is not enabled, allowing the out-of-bounds access to proceed. The resolution replaces the non-enforcing warning with frame dropping logic that prevents processing when the firmware returns an invalid key index.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates from stable branches when available
  • Monitor NVD for CVSS scoring once analysis completes
  • Review b43 driver configurations on systems using Broadcom 43xx wireless hardware
  • Validate that production kernel builds do not disable WARN_ON enforcement macros

Evidence notes

CVE published 2026-05-28. Linux kernel stable branch commits provided as references. No CVSS score or severity assigned by NVD at time of disclosure (status: Awaiting Analysis). No KEV listing.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46122 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46122

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46122 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46122

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1e9e55cf66f0fa4799f4d86ef3aaba8e606b5c14

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1f4f78bf8549e6ac4f04fba4176854f3a6e0c332

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/219ba67e69e49681e48c822d6eaafb5def032f34

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c3d7b90dc95020cd9282c4630e402fe224f7644e

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d7029879bafdac2006c67553807d122283dc6cbf

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.