CVE-2026-43113: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-43113 Overview

CVE-2026-43113 is a Linux kernel vulnerability in the wl1251 WiFi driver. The function wl1251_tx_packet_cb() uses a firmware-supplied completion ID directly as an index into the fixed 16-entry wl->tx_frames[] array. The ID is a raw u8 value read from the completion block, and the callback does not validate that it stays within array bounds before dereferencing it. This out-of-bounds access [CWE-125/CWE-787] originates at a trust boundary between firmware-supplied data and kernel memory. The fix rejects completion IDs that fall outside wl->tx_frames[] and consolidates the check with the existing NULL guard.

Critical Impact
A malformed or malicious firmware completion ID can cause the kernel to dereference memory outside the tx_frames[] array, leading to memory corruption or denial of service in the WiFi subsystem.

Affected Products

Linux kernel versions containing the wl1251 WiFi driver prior to the fix
Devices using TI WL1251 WiFi chipsets (mainline kernel drivers/net/wireless/ti/wl1251)
Stable kernel branches addressed by commits 0fd56fa, 26ee518, 8d7465b, b6ba1eac, and df15adc6

Discovery Timeline

2026-05-06 - CVE-2026-43113 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43113

Vulnerability Analysis

The wl1251 driver tracks in-flight transmit frames in a fixed-size 16-entry array wl->tx_frames[]. When the firmware reports a transmission completion, the kernel callback wl1251_tx_packet_cb() reads a packet ID from the completion block and uses that ID directly as the array index. Because the ID is an unsigned 8-bit integer with a value range of 0–255, any value greater than 15 indexes past the end of the array. The driver previously verified only that the resolved entry was non-NULL, which is insufficient when the index itself is out of range. Reading or writing through such an index can corrupt adjacent kernel data structures or trigger a kernel oops.

Root Cause

The root cause is missing input validation at a firmware-to-kernel trust boundary. The completion ID is treated as trustworthy and used as an array index without bounds checking. Firmware misbehavior, hardware faults, or a tampered firmware image can supply IDs that exceed the array length and lead to out-of-bounds memory access.

Attack Vector

Exploitation requires the system to process a wl1251 TX completion containing an out-of-range packet ID. The condition can arise from a faulty or malicious firmware blob, hardware-induced data corruption on the host interface, or anomalous device behavior. The vulnerability is local to systems that load the wl1251 driver against affected hardware. There is no published proof-of-concept and the issue is rated as low-likelihood exploitation, with an EPSS probability of 0.018%.

No verified exploit code exists. See the upstream patches for the corrective logic: Kernel Git Commit 0fd56fa, Kernel Git Commit 26ee518, Kernel Git Commit 8d7465b, Kernel Git Commit b6ba1eac, and Kernel Git Commit df15adc6.

Detection Methods for CVE-2026-43113

Indicators of Compromise

Kernel oops or panic messages referencing wl1251_tx_packet_cb or the wl1251 module in dmesg and /var/log/kern.log.
Unexpected reloads of the wl1251 driver or repeated WiFi interface resets on devices using TI WL1251 chipsets.
KASAN reports flagging out-of-bounds access in tx_frames when running an instrumented kernel.

Detection Strategies

Inventory hosts running kernels that include the unpatched wl1251 driver and confirm presence of TI WL1251 hardware.
Compare installed kernel package versions against vendor advisories listing the upstream commits referenced above.
Run KASAN-enabled kernels in test environments to surface out-of-bounds reads or writes during WiFi traffic.

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on wl1251 warnings, oops traces, or BUG reports.
Track WiFi driver crash rates per device class to detect anomalous patterns associated with embedded or IoT hardware.
Monitor patch compliance for stable kernel branches consuming the listed fix commits.

How to Mitigate CVE-2026-43113

Immediate Actions Required

Apply the upstream Linux kernel patches that add bounds validation to wl1251_tx_packet_cb() before dereferencing wl->tx_frames[].
Update to a stable kernel release that incorporates commits 0fd56fa, 26ee518, 8d7465b, b6ba1eac, or df15adc6, depending on the branch in use.
Verify the kernel build for embedded and IoT devices that ship the wl1251 driver, since these are the most common deployment targets.

Patch Information

The fix rejects firmware completion IDs that fall outside the bounds of wl->tx_frames[] and folds the check into the existing NULL guard. This keeps the change isolated to the trust boundary without altering the rest of the completion flow. Distribution kernels should pull the corresponding stable backport for their supported branches.

Workarounds

Unload the wl1251 driver with modprobe -r wl1251 on systems that do not require WL1251 WiFi functionality.
Blacklist the module via /etc/modprobe.d/blacklist-wl1251.conf to prevent automatic loading at boot until a patched kernel is deployed.
Restrict access to vulnerable devices and ensure firmware images for the WL1251 chipset come from trusted, signed sources.

bash

# Configuration example: blacklist the wl1251 driver until patched
echo "blacklist wl1251" | sudo tee /etc/modprobe.d/blacklist-wl1251.conf
sudo modprobe -r wl1251
uname -r   # verify kernel version, then upgrade to a release containing the fix