CVE-2026-74408

In the Linux kernel, the ath9k WiFi driver had an out-of-bounds access in the firmware TX status queue handling. Specifically, ath_tx_edma_tasklet() could access sc->tx.txq[ts.qid], where ts.qid is a 4-bit hardware field (0–15) but the txq array exposes only ATH9K_NUM_TX_QUEUES (10) entries, a...