CVE-2026-46122: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-46122 Overview

CVE-2026-46122 is an out-of-bounds read vulnerability in the Linux kernel's b43 wireless driver. The flaw resides in the b43_rx() function, which processes received Wi-Fi frames. A firmware-controlled key index can exceed the bounds of the dev->key[] array, which holds 58 entries. The existing B43_WARN_ON check is non-enforcing in production builds, allowing the out-of-bounds read to proceed instead of stopping it. The fix converts the check into an enforcing one that drops the frame when the firmware returns an invalid key index. This issue affects Linux systems using Broadcom 43xx wireless chipsets with the b43 driver.

Critical Impact
An out-of-bounds read in the kernel-space b43_rx() receive path may expose adjacent kernel memory or destabilize the system when malformed firmware-supplied indices are processed.

Affected Products

Linux kernel b43 wireless driver (Broadcom 43xx Wi-Fi chipsets)
Kernel branches referenced in stable-tree fix commits
Distributions shipping the b43 driver without the upstream fix

Discovery Timeline

2026-05-28 - CVE-2026-46122 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46122

Vulnerability Analysis

The b43 driver supports Broadcom 43xx Wi-Fi hardware in the Linux kernel. When a frame is received, b43_rx() retrieves a key index supplied by the device firmware and uses it to look up an entry in dev->key[]. That array holds 58 entries. The firmware-controlled value is not validated as a hard constraint. The driver instead relies on B43_WARN_ON, a macro that issues a warning but does not stop execution in production kernel builds. When the firmware returns an index greater than 57, the driver reads memory beyond the dev->key[] array. This produces an out-of-bounds read inside the kernel's receive path, which runs in software interrupt context.

Root Cause

The root cause is missing bounds enforcement on attacker-influenceable input from device firmware. The defensive macro present in the code is advisory rather than enforcing, so invalid indices flow into array indexing without rejection [CWE-125: Out-of-Bounds Read]. The upstream fix elevates B43_WARN_ON to an enforcing check that drops the offending frame, blocking the out-of-bounds access.

Attack Vector

The vulnerable code path executes when frames are received by a Broadcom 43xx Wi-Fi adapter using the b43 driver. Triggering the flaw requires the device firmware to emit an invalid key index for a received frame. An attacker capable of influencing firmware state — through compromised firmware, replaced firmware blobs, or hardware-level interference with the wireless adapter — could cause the kernel to read out-of-bounds memory. Standard remote Wi-Fi traffic alone does not directly control the index, since the value originates inside the device. See the upstream patch commits for details: Kernel commit 1e9e55cf, commit 1f4f78bf, commit 219ba67e, commit c3d7b90d, and commit d7029879.

Detection Methods for CVE-2026-46122

Indicators of Compromise

Kernel warning messages originating from B43_WARN_ON checks inside b43_rx() in dmesg or journal output.
Repeated b43 driver warnings, dropped frames, or unexplained Wi-Fi instability on hosts using Broadcom 43xx chipsets.
KASAN (Kernel Address Sanitizer) reports flagging out-of-bounds reads in the b43 receive path on instrumented kernels.

Detection Strategies

Inventory Linux hosts that load the b43 kernel module using lsmod | grep b43 and correlate with installed kernel version.
Compare running kernel versions against the stable-tree commits that introduce the enforcing bounds check.
Review kernel logs for WARN traces referencing b43_rx or key index values in the driver.

Monitoring Recommendations

Forward dmesg and journald kernel events to centralized log storage and alert on b43 warnings.
Track kernel package versions across the fleet to confirm patched builds are deployed on systems using Broadcom 43xx hardware.
Monitor for unexpected driver reloads or wireless interface resets on affected hosts.

How to Mitigate CVE-2026-46122

Immediate Actions Required

Update the Linux kernel to a stable release that includes the upstream b43_rx() bounds-check fix referenced in the kernel.org commits.
On systems that do not require Broadcom 43xx Wi-Fi, blacklist the b43 module to remove the vulnerable code path entirely.
Audit endpoints and embedded devices for the b43 driver and prioritize patching those exposed to untrusted wireless environments.

Patch Information

The fix makes the B43_WARN_ON check enforcing and drops frames when the firmware returns an invalid key index. It is available in the mainline kernel and backported through the stable tree in the commits 1e9e55cf66f0, 1f4f78bf8549, 219ba67e69e4, c3d7b90dc950, and d7029879bafd. Apply the kernel update provided by your Linux distribution.

Workarounds

Unload and blacklist the b43 module on systems that do not require Broadcom 43xx wireless support.
Disable the affected wireless interface on hosts that cannot be patched immediately.
Restrict physical access to systems using vulnerable Broadcom 43xx adapters to reduce the risk of firmware tampering.

bash

# Configuration example
# Blacklist the b43 driver until the kernel is patched
echo "blacklist b43" | sudo tee /etc/modprobe.d/blacklist-b43.conf
sudo modprobe -r b43
sudo update-initramfs -u