CVE-2026-74408 (GCVE-0-2026-74408)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:59 – Updated: 2026-08-17 05:46
VLAI
Title
wifi: ath9k: fix OOB access from firmware tx status queue ID
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: fix OOB access from firmware tx status queue ID ath_tx_edma_tasklet() accesses sc->tx.txq[ts.qid] where ts.qid is a 4-bit hardware field (0-15), but the txq array only has ATH9K_NUM_TX_QUEUES (10) entries. A qid >= 10 causes an OOB array access. Add a bounds check on ts.qid before using it as an array index.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: fce041beb03f93c7a771f0b4b6c45bb71ef90901 , < fb11083db9d7d6fb8f98bbba1cbfcf3fb7b4bf54 (git)
Affected: fce041beb03f93c7a771f0b4b6c45bb71ef90901 , < 734db72d55ca578a344dfa33e30145032c074b25 (git)
Affected: fce041beb03f93c7a771f0b4b6c45bb71ef90901 , < f5931d06b45ed402572bfe5832fff15864ef5481 (git)
Affected: fce041beb03f93c7a771f0b4b6c45bb71ef90901 , < 46ca1451f61b598f45cb5259e066d305444d95fc (git)
Affected: fce041beb03f93c7a771f0b4b6c45bb71ef90901 , < a9e055ac62cb3fcea262d4b687ec73eed82b3379 (git)
Affected: fce041beb03f93c7a771f0b4b6c45bb71ef90901 , < 5435fd3edcb11c7cc4002847c83e9a50b49284dc (git)
Affected: fce041beb03f93c7a771f0b4b6c45bb71ef90901 , < 336d4c8cd9b1646060ee690c881d465dfc09c6c0 (git)
Affected: fce041beb03f93c7a771f0b4b6c45bb71ef90901 , < 7ce2f118a2389e8f0a64068c6fe7cc7d40639be0 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.1
Unaffected: 0 , < 3.1 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath9k/xmit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fb11083db9d7d6fb8f98bbba1cbfcf3fb7b4bf54",
              "status": "affected",
              "version": "fce041beb03f93c7a771f0b4b6c45bb71ef90901",
              "versionType": "git"
            },
            {
              "lessThan": "734db72d55ca578a344dfa33e30145032c074b25",
              "status": "affected",
              "version": "fce041beb03f93c7a771f0b4b6c45bb71ef90901",
              "versionType": "git"
            },
            {
              "lessThan": "f5931d06b45ed402572bfe5832fff15864ef5481",
              "status": "affected",
              "version": "fce041beb03f93c7a771f0b4b6c45bb71ef90901",
              "versionType": "git"
            },
            {
              "lessThan": "46ca1451f61b598f45cb5259e066d305444d95fc",
              "status": "affected",
              "version": "fce041beb03f93c7a771f0b4b6c45bb71ef90901",
              "versionType": "git"
            },
            {
              "lessThan": "a9e055ac62cb3fcea262d4b687ec73eed82b3379",
              "status": "affected",
              "version": "fce041beb03f93c7a771f0b4b6c45bb71ef90901",
              "versionType": "git"
            },
            {
              "lessThan": "5435fd3edcb11c7cc4002847c83e9a50b49284dc",
              "status": "affected",
              "version": "fce041beb03f93c7a771f0b4b6c45bb71ef90901",
              "versionType": "git"
            },
            {
              "lessThan": "336d4c8cd9b1646060ee690c881d465dfc09c6c0",
              "status": "affected",
              "version": "fce041beb03f93c7a771f0b4b6c45bb71ef90901",
              "versionType": "git"
            },
            {
              "lessThan": "7ce2f118a2389e8f0a64068c6fe7cc7d40639be0",
              "status": "affected",
              "version": "fce041beb03f93c7a771f0b4b6c45bb71ef90901",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath9k/xmit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.1"
            },
            {
              "lessThan": "3.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k: fix OOB access from firmware tx status queue ID\n\nath_tx_edma_tasklet() accesses sc-\u003etx.txq[ts.qid] where ts.qid is a\n4-bit hardware field (0-15), but the txq array only has\nATH9K_NUM_TX_QUEUES (10) entries. A qid \u003e= 10 causes an OOB array\naccess.\n\nAdd a bounds check on ts.qid before using it as an array index."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - Exploitation requires sending 802.11 frames over WiFi to a victim using an EDMA-capable ath9k device (routers, embedded APs, laptops); TX completion interrupts from that traffic reach ath_tx_edma_tasklet() via ath_isr/ath9k_interrupt.\nAC:L - An adjacent attacker can repeatedly induce TX completions and error/status conditions with crafted or high-volume 802.11 traffic; they control timing and load on both sides of the race, making invalid firmware qid values (10-15) reachable without conditions outside attacker influence.\nPR:N - No local account or kernel privileges are required; unauthenticated adjacent WiFi frames (probes, data, deauth/flood) cause the victim radio to transmit and process firmware TX status reports on the interrupt path.\nUI:N - No victim interaction is needed beyond the device having WiFi active, which is the normal operating state for routers, phones, and IoT APs using ath9k hardware.\nS:U - Impact is confined to kernel memory corruption and privilege escalation or denial of service on the affected host; it does not cross VM, container, or IOMMU security boundaries.\nC:H - Out-of-bounds indexing of sc-\u003etx.txq[ts.qid] reads adjacent ath_softc/ath_tx fields as struct ath_txq (spinlocks, list heads, DMA metadata), constituting an unbounded OOB kernel memory read exploitable for information disclosure.\nI:H - The OOB txq pointer is dereferenced for spin_lock_bh, list_head manipulation, and ath_tx_process_buffer(), writing through misaligned kernel structures and enabling heap corruption and potential arbitrary code execution.\nA:H - Locking and list operations on memory interpreted as the wrong ath_txq can cause kernel oops, panic, or hang, and repeated adjacent triggering can sustain denial of service on the wireless host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:46:51.612Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fb11083db9d7d6fb8f98bbba1cbfcf3fb7b4bf54"
        },
        {
          "url": "https://git.kernel.org/stable/c/734db72d55ca578a344dfa33e30145032c074b25"
        },
        {
          "url": "https://git.kernel.org/stable/c/f5931d06b45ed402572bfe5832fff15864ef5481"
        },
        {
          "url": "https://git.kernel.org/stable/c/46ca1451f61b598f45cb5259e066d305444d95fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/a9e055ac62cb3fcea262d4b687ec73eed82b3379"
        },
        {
          "url": "https://git.kernel.org/stable/c/5435fd3edcb11c7cc4002847c83e9a50b49284dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/336d4c8cd9b1646060ee690c881d465dfc09c6c0"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ce2f118a2389e8f0a64068c6fe7cc7d40639be0"
        }
      ],
      "title": "wifi: ath9k: fix OOB access from firmware tx status queue ID",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74408",
    "datePublished": "2026-08-15T05:59:16.701Z",
    "dateReserved": "2026-08-15T05:44:03.892Z",
    "dateUpdated": "2026-08-17T05:46:51.612Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74408",
      "date": "2026-09-28",
      "epss": "0.00412",
      "percentile": "0.32901"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/ath/ath9k/xmit.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "fb11083db9d7d6fb8f98bbba1cbfcf3fb7b4bf54",
                    "status": "affected",
                    "version": "fce041beb03f93c7a771f0b4b6c45bb71ef90901",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "734db72d55ca578a344dfa33e30145032c074b25",
                    "status": "affected",
                    "version": "fce041beb03f93c7a771f0b4b6c45bb71ef90901",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f5931d06b45ed402572bfe5832fff15864ef5481",
                    "status": "affected",
                    "version": "fce041beb03f93c7a771f0b4b6c45bb71ef90901",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "46ca1451f61b598f45cb5259e066d305444d95fc",
                    "status": "affected",
                    "version": "fce041beb03f93c7a771f0b4b6c45bb71ef90901",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a9e055ac62cb3fcea262d4b687ec73eed82b3379",
                    "status": "affected",
                    "version": "fce041beb03f93c7a771f0b4b6c45bb71ef90901",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5435fd3edcb11c7cc4002847c83e9a50b49284dc",
                    "status": "affected",
                    "version": "fce041beb03f93c7a771f0b4b6c45bb71ef90901",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "336d4c8cd9b1646060ee690c881d465dfc09c6c0",
                    "status": "affected",
                    "version": "fce041beb03f93c7a771f0b4b6c45bb71ef90901",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7ce2f118a2389e8f0a64068c6fe7cc7d40639be0",
                    "status": "affected",
                    "version": "fce041beb03f93c7a771f0b4b6c45bb71ef90901",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/ath/ath9k/xmit.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.1"
                  },
                  {
                    "lessThan": "3.1",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k: fix OOB access from firmware tx status queue ID\n\nath_tx_edma_tasklet() accesses sc-\u003etx.txq[ts.qid] where ts.qid is a\n4-bit hardware field (0-15), but the txq array only has\nATH9K_NUM_TX_QUEUES (10) entries. A qid \u003e= 10 causes an OOB array\naccess.\n\nAdd a bounds check on ts.qid before using it as an array index."
          }
        ],
        "id": "CVE-2026-74408",
        "lastModified": "2026-08-17T06:19:36.100",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:42.837",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/336d4c8cd9b1646060ee690c881d465dfc09c6c0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/46ca1451f61b598f45cb5259e066d305444d95fc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5435fd3edcb11c7cc4002847c83e9a50b49284dc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/734db72d55ca578a344dfa33e30145032c074b25"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7ce2f118a2389e8f0a64068c6fe7cc7d40639be0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a9e055ac62cb3fcea262d4b687ec73eed82b3379"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f5931d06b45ed402572bfe5832fff15864ef5481"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fb11083db9d7d6fb8f98bbba1cbfcf3fb7b4bf54"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-20T22:18:22+00:00",
      "cve": "CVE-2026-74408",
      "id": "CVE-2026-74408",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: ath9k: fix OOB access from firmware tx status queue ID",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74408.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-10T02:02:15Z",
      "cve": "CVE-2026-74408",
      "id": "CVE-2026-74408",
      "initial_release_date": "2026-08-25T01:21:14Z",
      "product_status:known_affected": "265",
      "product_status:known_not_affected": "97",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74408",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74408.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.