PatchSiren cyber security CVE debrief

CVE-2026-46307 Linux CVE debrief

CVE-2026-46307 is a HIGH severity vulnerability in the Linux kernel, with a CVSS score of 8.3. The vulnerability is related to an out-of-bounds array access in the ath5k driver. The issue arises from the fact that 'ts->ts_final_idx' can be 3 on 5212, causing an out-of-bounds access when setting 'info->status.rates[ts->ts_final_idx + 1].idx = -1;'. The array 'rates' is defined as 'struct ieee80211_tx_rate rates[IEEE80211_TX_MAX_RATES];' with a size of 4, defined by '#define IEEE80211_TX_MAX_RATES 4'. The fix sets the 'idx = -1' sentinel only if the array index is less than the array size.

Vendor: Linux
Product: Unknown
CVSS: HIGH 8.3
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-06-08
Original CVE updated: 2026-07-23
Advisory published: 2026-06-08
Advisory updated: 2026-07-23

Who should care

Users of the Linux kernel, specifically those using the ath5k driver, should be aware of this vulnerability. The effect of the OOB write is negligible, but it is still important to patch the vulnerability to prevent potential exploits.

Technical summary

The vulnerability is caused by an out-of-bounds array access in the ath5k driver. The issue arises from the fact that 'ts->ts_final_idx' can be 3 on 5212, causing an out-of-bounds access when setting 'info->status.rates[ts->ts_final_idx + 1].idx = -1;'. The array 'rates' is defined as 'struct ieee80211_tx_rate rates[IEEE80211_TX_MAX_RATES];' with a size of 4, defined by '#define IEEE80211_TX_MAX_RATES 4'.

Defensive priority

HIGH

Recommended defensive actions

Apply the patch to fix the out-of-bounds array access in the ath5k driver.
Use a supported and patched version of the Linux kernel.

Evidence notes

The vulnerability was reported by Vincent and resolved by setting the 'idx = -1' sentinel only if the array index is less than the array size.

Sources and references

Verified primary and authoritative sources

CVE-2026-46307 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-46307

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-46307 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46307

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/568173ad9bd0b46cc6cd937dea8791e9b5eefa57

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/744c19e266b0d2628c5951439195dcef27eadacf

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/83226c71af53fb9b3cad40cb9a9a79f36d68c020

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/9dd6aae4bc7bfa11088d928670a3315eae542769

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/d6869537013b1f21b292342752d97868b79b5934

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/d748603f12baff112caa3ab7d39f50100f010dbd

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/e9f1081bc775146156def0dbc821b92f35d56afb

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.