Linux Kernel ath9k: Short WMI Response Buffer Overread
CVE-2026-98828 Published on October 18, 2026
wifi: ath9k: reject short WMI command responses
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k: reject short WMI command responses
ath9k_wmi_rsp_callback() removes the validated WMI header and copies
the number of bytes expected by the waiting command into its response
buffer. A device response shorter than that expectation can therefore
be read beyond the skb payload.
Record -EMSGSIZE for a short response, complete the waiter, and return
the stored status from the command path. This also prevents callers from
consuming stale response bytes as a successful reply.
Products Associated with CVE-2026-98828
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version fb9987d0f748c983bb795a86f47522313f701a08 and below 03ef61d05aa26022327f971b790f07e6bf6e35d6 is affected.
- Version fb9987d0f748c983bb795a86f47522313f701a08 and below e0c21130c1c7791ba73b19a3a9ea767c8cd43745 is affected.
- Version fb9987d0f748c983bb795a86f47522313f701a08 and below a3b0137c855a61371d9cf9993b8bcc33c9798202 is affected.
- Version fb9987d0f748c983bb795a86f47522313f701a08 and below 93ce8ea70451e800601bc9444aa33043de15d67b is affected.
- Version 2.6.35 is affected.
- Before 2.6.35 is unaffected.
- Version 6.12.113, <= 6.12.* is unaffected.
- Version 6.18.56, <= 6.18.* is unaffected.
- Version 7.2.10, <= 7.2.* is unaffected.
- Version 7.3-rc6, <= * is unaffected.