In the Linux kernel, the following vulnerability has been resolved:

wifi: ath9k: fix OOB access from firmware tx status queue ID

ath_tx_edma_tasklet() accesses sc->tx.txq[ts.qid] where ts.qid is a
4-bit hardware field (0-15), but the txq array only has
ATH9K_NUM_TX_QUEUES (10) entries. A qid >= 10 causes an OOB array
access.

Add a bounds check on ts.qid before using it as an array index.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
fce041beb03f93c7a771f0b4b6c45bb71ef90901 affected < fb11083db9d7d6fb8f98bbba1cbfcf3fb7b4bf54
fce041beb03f93c7a771f0b4b6c45bb71ef90901 affected < 734db72d55ca578a344dfa33e30145032c074b25
fce041beb03f93c7a771f0b4b6c45bb71ef90901 affected < f5931d06b45ed402572bfe5832fff15864ef5481
fce041beb03f93c7a771f0b4b6c45bb71ef90901 affected < 46ca1451f61b598f45cb5259e066d305444d95fc
fce041beb03f93c7a771f0b4b6c45bb71ef90901 affected < a9e055ac62cb3fcea262d4b687ec73eed82b3379
fce041beb03f93c7a771f0b4b6c45bb71ef90901 affected < 5435fd3edcb11c7cc4002847c83e9a50b49284dc
fce041beb03f93c7a771f0b4b6c45bb71ef90901 affected < 336d4c8cd9b1646060ee690c881d465dfc09c6c0
fce041beb03f93c7a771f0b4b6c45bb71ef90901 affected < 7ce2f118a2389e8f0a64068c6fe7cc7d40639be0
Linux Linux affected
Version Status Constraints
3.1 affected —
0 unaffected < 3.1
5.10.261 unaffected ≤ 5.10.*
5.15.212 unaffected ≤ 5.15.*
6.1.178 unaffected ≤ 6.1.*
6.6.145 unaffected ≤ 6.6.*
6.12.97 unaffected ≤ 6.12.*
6.18.40 unaffected ≤ 6.18.*
7.1.5 unaffected ≤ 7.1.*
7.2-rc1 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/336d4c8cd9b1646060ee690c881d465dfc09c6c0 cve-icon cve-icon
https://git.kernel.org/stable/c/46ca1451f61b598f45cb5259e066d305444d95fc cve-icon cve-icon
https://git.kernel.org/stable/c/5435fd3edcb11c7cc4002847c83e9a50b49284dc cve-icon cve-icon
https://git.kernel.org/stable/c/734db72d55ca578a344dfa33e30145032c074b25 cve-icon cve-icon
https://git.kernel.org/stable/c/7ce2f118a2389e8f0a64068c6fe7cc7d40639be0 cve-icon cve-icon
https://git.kernel.org/stable/c/a9e055ac62cb3fcea262d4b687ec73eed82b3379 cve-icon cve-icon
https://git.kernel.org/stable/c/f5931d06b45ed402572bfe5832fff15864ef5481 cve-icon cve-icon
https://git.kernel.org/stable/c/fb11083db9d7d6fb8f98bbba1cbfcf3fb7b4bf54 cve-icon cve-icon
History

Sat, 15 Aug 2026 06:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: fix OOB access from firmware tx status queue ID ath_tx_edma_tasklet() accesses sc->tx.txq[ts.qid] where ts.qid is a 4-bit hardware field (0-15), but the txq array only has ATH9K_NUM_TX_QUEUES (10) entries. A qid >= 10 causes an OOB array access. Add a bounds check on ts.qid before using it as an array index.
Title wifi: ath9k: fix OOB access from firmware tx status queue ID
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-15T05:59:16.701Z

Reserved: 2026-08-15T05:44:03.892Z

Link: CVE-2026-74408

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T06:22:42.837

Modified: 2026-08-15T06:22:42.837

Link: CVE-2026-74408

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.