Linux Kernel Wi-Fi subsystem Improper Validation Of Array Index Rated 7.8 CVSS

Last refreshed2026-10-15

Status: UPDATED | Advisory ID: CVE-2026-46122

Key Details

CVE	CVE-2026-46122
CVSS Score / Version	7.8 (High) / CVSS v3.1
Updated	2026-10-15
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel and Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
Classified as	CWE-129 (Improper Validation of Array Index)
Exploitation prediction (EPSS)	0.18% probability of exploitation in the next 30 days (7% percentile) -- FIRST.org's EPSS model.

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Siemens

SIMATIC S7-1500 TM MFP - GNU/Linux subsystem

Subsystems	Controllers & Field I/O, OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

wifi: b43: enforce bounds check on firmware key index in b43_rx()

The firmware-controlled key index in b43_rx() can exceed the dev->key[]

array size (58 entries). The existing B43_WARN_ON is non-enforcing in

production builds, allowing an out-of-bounds read.

Make the B43_WARN_ON check enforcing by dropping the frame when the

firmware returns an invalid key index. (NVD)

Monitor Linux's and Siemens's web pages for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-46122
CVE	https://www.cve.org/CVERecord?id=CVE-2026-46122

Source

Reference

NVD

CVE