Packet ID Validation Issue in Linux Kernel's wl1251 Wireless Driver

CVE-2026-43113

What is CVE-2026-43113?

A vulnerability exists in the WL1251 wireless driver within the Linux kernel that fails to validate packet IDs before indexing the tx_frames array. The wl1251_tx_packet_cb() function incorrectly uses the firmware completion ID to index directly into a fixed array without proper checks. If completion IDs fall outside the expected range, this can lead to undefined behavior or potential access violations. To mitigate this, it is crucial to implement strict validation of completion IDs against the bounds of the tx_frames array to maintain the integrity of the completion process.

References