CVE Explorer

CVE-2026-43113

In the Linux kernel, the following vulnerability has been resolved: wifi: wl1251: validate packet IDs before indexing tx_frames wl1251_tx_packet_cb() uses the firmware completion ID directly to index the fixed 16-entry wl->tx_frames[] array. The ID is a raw u8 from the completion block, and the callback does not currently verify that it fits the array before dereferencing it. Reject completion IDs that fall outside wl->tx_frames[] and keep the existing NULL check in the same guard. This keeps

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:e20889c51f1923df7a3b3ac3405b6cdd2a8a8006a7aa9b943f9905519b82a308

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/wireless/ti/wl1251/tx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6509dbece7339dbc8980c706b9d623119a6de105","status":"affected","version":"2f01a1f58889fbfeb68b1bc1b52e4197f3333490","versionType":"git"},{"lessThan":"a8a11a876f0a97061ee5d9e61d0f5a0df7e241c7","status":"affected","version":"2f01a1f58889fbfeb68b1bc1b52e4197f3333490","versionType":"git"},{"lessThan":"e0dc1ad870d6788b049bfe1511ac75b2333a7550","status":"affected","version":"2f01a1f588…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:5807bbb48f13c1f82313fa18f72b69c020921fbfd33e4632c9c6303df19950fe · sha256:7cbead34d14b1964… · /containers/cna/affected/0

{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/wireless/ti/wl1251/tx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.31"},{"lessThan":"2.6.31","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:5807bbb48f13c1f82313fa18f72b69c020921fbfd33e4632c9c6303df19950fe · sha256:7cbead34d14b1964… · /containers/cna/affected/1

Affected products and versions

2 source assertions

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:5807bbb48f13c1f82313fa18f72b69c020921fbfd33e4632c9c6303df19950fe · sha256:7cbead34d14b1964… · /containers/cna/affected/0

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:5807bbb48f13c1f82313fa18f72b69c020921fbfd33e4632c9c6303df19950fe · sha256:7cbead34d14b1964… · /containers/cna/affected/1

Provider-owned CVSS observations

1 source assertion

{"metric":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:5807bbb48f13c1f82313fa18f72b69c020921fbfd33e4632c9c6303df19950fe · sha256:7cbead34d14b1964… · /containers/cna/metrics/0/cvssV3_1

Source references

8 source assertions

{"url":"https://git.kernel.org/stable/c/0fd56fad9c56356e7fa7a7c52e7ecbf807a44eb0"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:5807bbb48f13c1f82313fa18f72b69c020921fbfd33e4632c9c6303df19950fe · sha256:7cbead34d14b1964… · /containers/cna/references/7

{"url":"https://git.kernel.org/stable/c/26ee518695c484f75e3606d631278e84bd24ae02"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:5807bbb48f13c1f82313fa18f72b69c020921fbfd33e4632c9c6303df19950fe · sha256:7cbead34d14b1964… · /containers/cna/references/6

{"url":"https://git.kernel.org/stable/c/6509dbece7339dbc8980c706b9d623119a6de105"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:5807bbb48f13c1f82313fa18f72b69c020921fbfd33e4632c9c6303df19950fe · sha256:7cbead34d14b1964… · /containers/cna/references/0

{"url":"https://git.kernel.org/stable/c/8d7465be5163a923ee5d7459719ef5a021c1584a"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:5807bbb48f13c1f82313fa18f72b69c020921fbfd33e4632c9c6303df19950fe · sha256:7cbead34d14b1964… · /containers/cna/references/5

{"url":"https://git.kernel.org/stable/c/a8a11a876f0a97061ee5d9e61d0f5a0df7e241c7"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:5807bbb48f13c1f82313fa18f72b69c020921fbfd33e4632c9c6303df19950fe · sha256:7cbead34d14b1964… · /containers/cna/references/1

{"url":"https://git.kernel.org/stable/c/b6ba1eacf276063ebeefbbae8056043c24f2efaf"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:5807bbb48f13c1f82313fa18f72b69c020921fbfd33e4632c9c6303df19950fe · sha256:7cbead34d14b1964… · /containers/cna/references/3

{"url":"https://git.kernel.org/stable/c/df15adc692a802636dd3f258fc7cca8bf7a0ed9a"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:5807bbb48f13c1f82313fa18f72b69c020921fbfd33e4632c9c6303df19950fe · sha256:7cbead34d14b1964… · /containers/cna/references/4

{"url":"https://git.kernel.org/stable/c/e0dc1ad870d6788b049bfe1511ac75b2333a7550"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:5807bbb48f13c1f82313fa18f72b69c020921fbfd33e4632c9c6303df19950fe · sha256:7cbead34d14b1964… · /containers/cna/references/2

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer