Linux Kernel ath9k_htc Tx Aggregation Buffer Overflow
CVE-2026-98827 Published on October 18, 2026
wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE
__hif_usb_tx() dequeues up to MAX_TX_AGGR_NUM (20) frames into a
single tx_buf of MAX_TX_BUF_SIZE (32768) bytes, limiting the batch
by record count but never by cumulative byte length.
With large frames (MTU 2304), 20 aggregated frames of 2292 bytes
each exceed the allocation (20 * 2296 = 45920 bytes), so the
memcpy() in the loop writes up to 13152 bytes past tx_buf->buf
before usb_submit_urb().
Peek the queue head and stop before copying any record that would
cross MAX_TX_BUF_SIZE, then dispatch the current batch. Leftover
skbs remain queued and are drained on the next URB completion.
The byte bound changes the loop's exit semantics: it can now exit
before i == tx_skb_cnt - 1. Stock only finalized tx_buf->len on
that last index (len += offset), so an early break would submit a
URB holding only the last record's length while every dequeued skb
is freed on completion, silently dropping frames. Make tx_buf->len
a running total and advance tx_buf->offset per record instead; the
stride round_up(nskb->len + 4, 4) is identical to the stock stride
when the loop runs to completion.
Tested on hardware with an MTU 2304 flood: the loop stops at
record 15 (len = 32144, offset = 32144, within 32768), no
oversized URB is submitted, and MTU 1500 pings pass 20/20.
Products Associated with CVE-2026-98827
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version fb9987d0f748c983bb795a86f47522313f701a08 and below c18882768a0fe253c70986c5fe66d9241570fbc4 is affected.
- Version fb9987d0f748c983bb795a86f47522313f701a08 and below 345ce265cf604e84b5b560c21beaf4c6f269ab14 is affected.
- Version fb9987d0f748c983bb795a86f47522313f701a08 and below e73a619f91b6cfec47bc1a94aea28df6849e5be3 is affected.
- Version fb9987d0f748c983bb795a86f47522313f701a08 and below aeaca27c1db3106967ffbb2b517d98c835f6d500 is affected.
- Version 2.6.35 is affected.
- Before 2.6.35 is unaffected.
- Version 6.12.113, <= 6.12.* is unaffected.
- Version 6.18.56, <= 6.18.* is unaffected.
- Version 7.2.10, <= 7.2.* is unaffected.
- Version 7.3-rc6, <= * is unaffected.