PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-74408 Linux CVE debrief

A PatchSiren debrief of CVE-2026-74408, a high-severity vulnerability in the Linux kernel's ath9k driver. This vulnerability can lead to out-of-bounds (OOB) access, potentially allowing an attacker to compromise the system. The issue arises from the ath_tx_edma_tasklet() function accessing sc->tx.txq[ts.qid] where ts.qid is a 4-bit hardware field (0-15), but the txq array only has 10 entries. A qid >= 10 causes an OOB array access. The vulnerability has been resolved with a bounds check on ts.qid before using it as an array index. Linux kernel developers and maintainers, Linux distribution maintainers, and users of affected Linux kernel versions should assess exposure and apply the

Vendor
Linux
Product
Unknown
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-15
Original CVE updated
2026-10-16
Advisory published
2026-08-15
Advisory updated
2026-10-16

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of affected Linux kernel versions should assess exposure and apply patches or compensating controls as needed.

Why it matters

CVE-2026-74408 is a high-severity vulnerability in the Linux kernel's ath9k driver that can lead to OOB access and potential system compromise. Linux kernel developers and maintainers, Linux distribution maintainers, and users of affected Linux kernel versions should assess exposure and apply patches or compensating controls as needed.

  • Verify affected Linux kernel versions and apply patches or updates
  • Monitor for potential exploitation attempts
  • Apply compensating controls if patch cannot be applied

Technical summary

The Linux kernel's ath9k driver is vulnerable to an out-of-bounds (OOB) access issue. The ath_tx_edma_tasklet() function accesses sc->tx.txq[ts.qid] where ts.qid is a 4-bit hardware field (0-15), but the txq array only has 10 entries. A qid >= 10 causes an OOB array access. The issue has been resolved with a bounds check on ts.qid before using it as an array index. This vulnerability can be mitigated by applying patches or updates to the fixed Linux kernel version, verifying affected versions, and implementing compensating controls if patches cannot be applied.

Defensive priority

Apply patch or update to fixed version; verify affected versions

Recommended defensive actions

  • Apply patch or update to fixed Linux kernel version
  • Verify affected versions and apply compensating controls if patch cannot be applied
  • Monitor for potential exploitation attempts
  • Perform asset inventory to identify potentially exposed systems
  • Review and implement compensating controls for exposed systems
  • Track exceptions and retest remediated assets
  • Close the item only after evidence is documented

Evidence notes

The Linux kernel's ath9k driver is vulnerable to an out-of-bounds (OOB) access issue. The ath_tx_edma_tasklet() function accesses sc->tx.txq[ts.qid] where ts.qid is a 4-bit hardware field (0-15), but the txq array only has 10 entries. A qid >= 10 causes an OOB array access. The issue has been resolved with a bounds check on ts.qid before using it as an array index.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-74408 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-74408

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-74408 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-74408

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • wifi: ath9k: fix OOB access from firmware tx status queue ID

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/74xxx/CVE-2026-74408.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/fb11083db9d7d6fb8f98bbba1cbfcf3fb7b4bf54

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/734db72d55ca578a344dfa33e30145032c074b25

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f5931d06b45ed402572bfe5832fff15864ef5481

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/46ca1451f61b598f45cb5259e066d305444d95fc

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a9e055ac62cb3fcea262d4b687ec73eed82b3379

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/5435fd3edcb11c7cc4002847c83e9a50b49284dc

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/336d4c8cd9b1646060ee690c881d465dfc09c6c0

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.