Out-of-Bounds Access in Linux Kernel Affecting ath9k Driver

CVE-2026-74408

What is CVE-2026-74408?

The vulnerability arises in the Linux kernel's ath9k Wi-Fi driver due to improper bounds checking of the transmission status queue ID. The function ath_tx_edma_tasklet() attempts to access an index of the txq array using a qid that can exceed its allocated range. Specifically, the qid is a 4-bit value (ranging from 0-15), while the txq array holds only 10 entries. As a consequence, when the qid is 10 or greater, it can lead to an out-of-bounds array access, potentially resulting in undefined behavior and security risks.

References