In the Linux kernel, the following vulnerability has been resolved:
wifi: wl1251: validate packet IDs before indexing tx_frames
wl1251_tx_packet_cb() uses the firmware completion ID directly to index
the fixed 16-entry wl->tx_frames[] array. The ID is a raw u8 from the
completion block, and the callback does not currently verify that it
fits the array before dereferencing it.
Reject completion IDs that fall outside wl->tx_frames[] and keep the
existing NULL check in the same guard. This keeps the fix local to the
trust boundary and avoids touching the rest of the completion flow.
References
Configurations
Configuration 1 (hide)
|
History
01 Jun 2026, 17:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
08 May 2026, 17:58
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-476 | |
| References | () https://git.kernel.org/stable/c/0fd56fad9c56356e7fa7a7c52e7ecbf807a44eb0 - Patch | |
| References | () https://git.kernel.org/stable/c/26ee518695c484f75e3606d631278e84bd24ae02 - Patch | |
| References | () https://git.kernel.org/stable/c/8d7465be5163a923ee5d7459719ef5a021c1584a - Patch | |
| References | () https://git.kernel.org/stable/c/b6ba1eacf276063ebeefbbae8056043c24f2efaf - Patch | |
| References | () https://git.kernel.org/stable/c/df15adc692a802636dd3f258fc7cca8bf7a0ed9a - Patch | |
| First Time |
Linux linux Kernel
Linux |
|
| CPE | cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* |
08 May 2026, 13:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
06 May 2026, 10:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-06 10:16
Updated : 2026-06-01 17:17
NVD link : CVE-2026-43113
Mitre link : CVE-2026-43113
CVE.ORG link : CVE-2026-43113
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-476
NULL Pointer Dereference