CVE-2026-46163: Linux Kernel b43legacy Bounds Check Flaw

CVE-2026-46163 Overview

CVE-2026-46163 is an out-of-bounds read vulnerability in the Linux kernel's b43legacy wireless driver. The flaw exists in the receive path function b43legacy_rx(), where a firmware-controlled key index can exceed dev->max_nr_keys. The pre-existing B43legacy_WARN_ON check is non-enforcing in production kernel builds, permitting an out-of-bounds read of the dev->key[] array. The upstream fix makes the bounds check enforcing by dropping frames associated with invalid indices. The vulnerability mirrors a previously addressed issue in the sibling b43 driver.

Critical Impact
An attacker controlling Wi-Fi firmware behavior or radio input could trigger an out-of-bounds read in kernel memory, potentially leading to information disclosure or kernel instability.

Affected Products

Linux kernel branches containing the b43legacy wireless driver
Systems using Broadcom legacy Wi-Fi chipsets supported by b43legacy
Distributions shipping vulnerable upstream kernel versions prior to the referenced stable patches

Discovery Timeline

2026-05-28 - CVE-2026-46163 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46163

Vulnerability Analysis

The b43legacy driver supports legacy Broadcom wireless chipsets in the Linux kernel. During frame reception, b43legacy_rx() reads a key index from firmware-supplied metadata and uses it to index into the dev->key[] array. The kernel previously guarded this access with B43legacy_WARN_ON, a debug-only macro that does not enforce control flow in production builds.

When the firmware-reported key index exceeds dev->max_nr_keys, the driver continues processing the frame and dereferences memory beyond the valid bounds of the key array. This results in an out-of-bounds read of adjacent kernel memory. The attacker influence path runs through firmware-controlled fields in received Wi-Fi frames, making the issue reachable in environments where radio input or firmware integrity cannot be fully trusted.

Root Cause

The root cause is reliance on a non-enforcing debug assertion (B43legacy_WARN_ON) to validate untrusted input. The check emits a warning when triggered but does not abort frame processing or sanitize the index. Production builds therefore continue execution with an attacker-influenced index value, resulting in an out-of-bounds read [CWE-125].

Attack Vector

Exploitation requires the attacker to influence the firmware-controlled key index field that the driver consumes during RX processing. The vulnerability is local to the kernel's wireless stack and depends on the presence of a vulnerable b43legacy-supported adapter. Refer to the upstream commits for the exact code path: Kernel Git Commit Fix and Kernel Git Security Patch.

No verified public exploit code is available. The vulnerability is described in prose per the upstream commit message: the fix replaces the warning with an enforcing bounds check that drops frames carrying invalid indices.

Detection Methods for CVE-2026-46163

Indicators of Compromise

Kernel log entries referencing b43legacy_rx warnings or unexpected key index values
Unexplained kernel oops, panics, or KASAN out-of-bounds reports in the b43legacy module
Unusual wireless interface resets or driver reinitialization events on affected hardware

Detection Strategies

Inventory hosts running kernels that include the b43legacy driver and identify systems with Broadcom legacy Wi-Fi hardware in use.
Compare installed kernel versions against the upstream stable commits referenced in the NVD record to determine patch status.
Enable kernel address sanitizer (KASAN) in test environments to surface out-of-bounds reads in the wireless RX path.

Monitoring Recommendations

Forward dmesg and journald kernel logs to a centralized log platform and alert on b43legacy warnings or RX errors.
Track wireless driver crash signatures and module reloads across endpoints with vulnerable hardware.
Monitor patch compliance for Linux kernel updates referenced in the Kernel Git Commit Update advisories.

How to Mitigate CVE-2026-46163

Immediate Actions Required

Apply the upstream kernel patches from the referenced git.kernel.org stable commits to all affected Linux systems.
Identify and prioritize endpoints using Broadcom legacy Wi-Fi adapters bound to the b43legacy driver.
Where the driver is not required, unload or blacklist the b43legacy kernel module to eliminate the attack surface.

Patch Information

The fix is distributed across multiple Linux stable branches. Refer to the upstream commits: Kernel Git Commit Update, Kernel Git Commit Fix, Kernel Git Security Patch, Kernel Git Commit Changes, and Kernel Git Commit Enhancement. The patch converts the non-enforcing B43legacy_WARN_ON check into an enforcing bounds check that drops frames with invalid key indices.

Workarounds

Blacklist the b43legacy module on systems that do not require legacy Broadcom Wi-Fi support.
Disable or physically remove unused legacy Broadcom Wi-Fi adapters to remove the vulnerable code path.
Restrict use of the affected hardware to trusted radio environments until patched kernels are deployed.

bash

# Blacklist the b43legacy driver until kernel patches are applied
echo "blacklist b43legacy" | sudo tee /etc/modprobe.d/blacklist-b43legacy.conf
sudo modprobe -r b43legacy
sudo update-initramfs -u