PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46163 Linux CVE debrief

A bounds-checking vulnerability in the Linux kernel's b43legacy wireless driver could allow out-of-bounds memory access during frame reception. The b43legacy_rx() function accepts a firmware-controlled key index without enforcing validation against dev->max_nr_keys. While a B43legacy_WARN_ON macro exists, it is non-enforcing in production builds, permitting invalid indices to trigger out-of-bounds reads of the dev->key[] array. The fix converts this diagnostic warning into an enforced check that drops frames with invalid key indices.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-10
Advisory published
2026-05-28
Advisory updated
2026-06-10

Who should care

Organizations running Linux systems with legacy Broadcom wireless hardware (BCM4301, BCM4303, BCM4306, BCM4309, BCM4311, BCM4318) using the b43legacy driver; embedded/IoT devices with these chipsets; Linux distribution maintainers packaging kernel updates

Technical summary

The b43legacy wireless driver for legacy Broadcom chipsets contains a validation gap in its receive path. Frame metadata from firmware includes a key index field used to select encryption keys from dev->key[]. The existing B43legacy_WARN_ON() macro logs out-of-bounds conditions but does not prevent memory access in production builds where WARN_ON is non-fatal. An attacker able to influence firmware behavior or craft malicious frames could supply an index exceeding dev->max_nr_keys, resulting in out-of-bounds kernel memory reads. The resolution replaces the non-enforcing warning with an explicit bounds validation that drops frames carrying invalid key indices, matching the defensive pattern previously applied to the b43 driver.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the b43legacy bounds check fix when available from your Linux distribution
  • Monitor stable kernel branches for backported fixes if running long-term support kernels
  • Consider disabling b43legacy hardware if patches are unavailable and the threat model includes local network attackers
  • Review systems using Broadcom BCM4301/4303/4306/4309/4311/4318 wireless chipsets which utilize the b43legacy driver

Evidence notes

Vulnerability description confirms the issue exists in the RX path of the b43legacy WiFi driver. The fix pattern mirrors a prior correction in the related b43 driver. Multiple stable kernel branches received backports as evidenced by separate git.kernel.org stable commits.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46163 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46163

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46163 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46163

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1baaeb6adecb9691748c0253dab6ddd19a2b4e9e

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/6ee946077607d7783ae6709a899213fc4fe08f35

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9d1bc155802943e92c57a5fb923d23edfbf0b525

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a035766f970bde2d4298346a31a80685be5c0205

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/fdd4e51979f42ca8b1ab7e6176b607e1caabf2a5

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.