High 8.8Published May 6, 2026

CVE-2026-43113wifi: wl1251: validate packet IDs before indexing tx_frames

Updated under an hour ago (Oct 27, 2026, 10:40 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: wifi: wl1251: validate packet IDs before indexing tx_frames wl1251_tx_packet_cb() uses the firmware completion ID directly to index the fixed 16-entry wl->tx_frames[] array. The ID is a raw u8 from the completion block, and the callback does not currently verify that it fits the array before dereferencing it. Reject completion IDs that fall outside wl->tx_frames[] and keep the existing NULL check in the same guard. This keeps the fix local to the trust boundary and avoids touching the rest of the completion flow.

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 2f01a1f58889fbfeb68b1bc1b52e4197f3333490 before 6509dbece7339dbc8980c706b9d623119a6de105; from 2f01a1f58889fbfeb68b1bc1b52e4197f3333490 before a8a11a876f0a97061ee5d9e61d0f5a0df7e241c7; from 2f01a1f58889fbfeb68b1bc1b52e4197f3333490 before e0dc1ad870d6788b049bfe1511ac75b2333a7550; from 2f01a1f58889fbfeb68b1bc1b52e4197f3333490 before b6ba1eacf276063ebeefbbae8056043c24f2efaf; from 2f01a1f58889fbfeb68b1bc1b52e4197f3333490 before df15adc692a802636dd3f258fc7cca8bf7a0ed9a; from 2f01a1f58889fbfeb68b1bc1b52e4197f3333490 before 8d7465be5163a923ee5d7459719ef5a021c1584a; from 2f01a1f58889fbfeb68b1bc1b52e4197f3333490 before 26ee518695c484f75e3606d631278e84bd24ae02; 2f01a1f58889fbfeb68b1bc1b52e4197f3333490 builds before 0fd56fad9c56356e7fa7a7c52e7ecbf807a44eb0	CNA record
linux linux_kernel linux:linux_kernel	from 2.6.31 before 6.6.136; from 6.7 before 6.12.83; from 6.13 before 6.18.24; from 6.19 before 6.19.14; 7.0; 7.0; 7.0; 7.0; and 2 more ranges	NVD

References

References

https://git.kernel.org/stable/c/6509dbece7339dbc8980c706b9d623119a6de105
https://git.kernel.org/stable/c/a8a11a876f0a97061ee5d9e61d0f5a0df7e241c7
https://git.kernel.org/stable/c/e0dc1ad870d6788b049bfe1511ac75b2333a7550
https://git.kernel.org/stable/c/b6ba1eacf276063ebeefbbae8056043c24f2efaf	patch
https://git.kernel.org/stable/c/df15adc692a802636dd3f258fc7cca8bf7a0ed9a	patch
https://git.kernel.org/stable/c/8d7465be5163a923ee5d7459719ef5a021c1584a	patch
https://git.kernel.org/stable/c/26ee518695c484f75e3606d631278e84bd24ae02	patch
https://git.kernel.org/stable/c/0fd56fad9c56356e7fa7a7c52e7ecbf807a44eb0	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.