CVE-2026-74408

A flaw was found in the Linux kernel's ath9k Wi-Fi driver. This vulnerability arises from an out-of-bounds memory access within the ath_tx_edma_tasklet() function. An internal queue identifier, which is a 4-bit hardware field, can exceed the bounds of the transmit queue array. This can lead to memory corruption, potentially allowing a local attacker to cause a denial of service or, in more severe cases, execute arbitrary code.

ath9k uses ts.qid from a firmware TX status field as an index into sc->tx.txq, but the hardware field can encode values 0 to 15 while the txq array has only 10 entries. A qid value of 10 or higher can make ath_tx_edma_tasklet access memory outside the array and then use the resulting pointer as a TX queue object, which can lead to kernel crash and potentially memory corruption. For the CVSS the PR:N is used in the paranoid adjacent-network interpretation because a WiFi radio neighbor may not need a local account if the invalid TX status can be induced through wireless interactions with an exposed ath9k interface. The base case is more conservative and treats reliable triggering as local and high complexity because the invalid qid originates from firmware or hardware status rather than directly from packet bytes. Impact is at least denial of service and in worst case may allow confidentiality or integrity impact due to out-of-bounds access in kernel driver state.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.