CVE-2026-46307: wifi: ath5k: do not access array OOB

Synopsis

An out-of-bounds array write exists in the Linux kernel's ath5k Wi-Fi driver (drivers/net/wireless/ath/ath5k/base.c). The flaw is reachable from the adjacent network, requires no authentication, and allows an attacker within Wi-Fi range to trigger the vulnerable transmit-completion path. Successful exploitation gives the attacker high-confidence read and write access to kernel memory regions, with limited disruption to service availability. Patched-image rebuilds at versions 5.10.258, 5.15.209, and 6.1.175 are available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on the same adjacent network segment, such as a local Wi-Fi network or LAN, to reach the vulnerable ath5k driver path; remote internet-based access is not sufficient.

• AuthenticationNot required

  No credentials or prior authentication are needed to trigger the out-of-bounds write through the ath5k transmit-completion tasklet.

• Victim interactionNot required

  No action from a user or operator on the target system is required; exploitation is passive from the victim's perspective.

• Attack complexityDetail

  Exploit conditions are straightforward and require no special timing, race conditions, or environmental prerequisites beyond adjacency to the wireless interface.

Blast Radius

• Attacker overwrites kernel memory adjacent to the rate array, specifically the ack_signal field in the tx status structure, enabling targeted memory manipulation.
• High confidentiality impact: kernel memory contents in the affected region can be read, including data structures that may hold sensitive network or session information.
• High integrity impact: the out-of-bounds write allows corruption of kernel data adjacent to the transmit-rate array, which can alter driver behavior or be leveraged for further exploitation.
• Limited availability impact: the write targets a narrow memory region and is unlikely to crash the system outright, though repeated triggering may cause unpredictable driver state.