{"id":"CVE-2026-98827","kind":"vulnerability","aliases":["CVE-2026-98827"],"related":[],"title":"Linux kernel: ath9k_htc USB Wi-Fi driver overflows TX buffer with large frames","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE\n\n__hif_usb_tx() dequeues up to MAX_TX_AGGR_NUM (20) frames into a\nsingle tx_buf of MAX_TX_BUF_SIZE (32768) bytes, limiting the batch\nby record count but never by cumulative byte length.\n\nWith large frames (MTU 2304), 20 aggregated frames of 2292 bytes\neach exceed the allocation (20 * 2296 = 45920 bytes), so the\nmemcpy() in the loop writes up to 13152 bytes past tx_buf->buf\nbefore usb_submit_urb().\n\nPeek the queue head and stop before copying any record that would\ncross MAX_TX_BUF_SIZE, then dispatch the current batch. Leftover\nskbs remain queued and are drained on the next URB completion.\n\nThe byte bound changes the loop's exit semantics: it can now exit\nbefore i == tx_skb_cnt - 1. Stock only finalized tx_buf->len on\nthat last index (len += offset), so an early break would submit a\nURB holding only the last record's length while every dequeued skb\nis freed on completion, silently dropping frames. Make tx_buf->len\na running total and advance tx_buf->offset per record instead; the\nstride round_up(nskb->len + 4, 4) is identical to the stock stride\nwhen the loop runs to completion.\n\nTested on hardware with an MTU 2304 flood: the loop stops at\nrecord 15 (len = 32144, offset = 32144, within 32768), no\noversized URB is submitted, and MTU 1500 pings pass 20/20.","summary":"The ath9k_htc driver for Atheros USB Wi-Fi adapters can copy more bytes than its transmit buffer holds when aggregating large frames, writing past the allocation in kernel memory. The sources do not say what an attacker can do with the overflow beyond memory corruption.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ath9k_htc","kernel","linux","runtime","usb","wifi"],"not_affected_if":["driver-not-loaded","no-ath9k-htc-hardware"],"how_to_check":"- `uname -r` to see the running kernel version\n- `lsmod | grep ath9k_htc` to check whether the driver is loaded\n- Check the distribution's advisory for the fixed kernel version, as the sources do not list one","fix":"- Update to a kernel release that includes the upstream commit bounding TX aggregation to MAX_TX_BUF_SIZE (fixed version: unknown)\n- Until patched, unload the driver with `modprobe -r ath9k_htc` if no USB ath9k_htc adapter is in use","status":"open","published_at":"2026-10-18T16:17:36+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:14:38+00:00","updated_at":"2026-10-25T05:14:38+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:14:38Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a kernel release that includes the upstream commit bounding TX aggregation to MAX_TX_BUF_SIZE (fixed version: unknown)\n- Until patched, unload the driver with `modprobe -r ath9k_htc` if no USB ath9k_htc adapter is in use","reach":"local","title":"Linux kernel: ath9k_htc USB Wi-Fi driver overflows TX buffer with large frames","impact":"high","summary":"The ath9k_htc driver for Atheros USB Wi-Fi adapters can copy more bytes than its transmit buffer holds when aggregating large frames, writing past the allocation in kernel memory. The sources do not say what an attacker can do with the overflow beyond memory corruption.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","wifi","usb","ath9k_htc"],"confidence":0.6,"needs_auth":"unknown","worst_case":"kernel memory past the transmit buffer is overwritten","analyst_note":"Check the kernel.org stable commit and distro advisories for the fixed kernel versions and whether the overflow is reachable from the network or only from the local USB device.","how_to_check":"- `uname -r` to see the running kernel version\n- `lsmod | grep ath9k_htc` to check whether the driver is loaded\n- Check the distribution's advisory for the fixed kernel version, as the sources do not list one","needs_analyst":true,"not_affected_if":["no-ath9k-htc-hardware","driver-not-loaded"],"who_is_affected":"Systems running a Linux kernel with the ath9k_htc driver and a USB Atheros Wi-Fi adapter, where large frames such as MTU 2304 are sent. Systems without this USB Wi-Fi hardware or driver are not affected. The sources do not say whether the flaw is reachable remotely.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000722,"input_tokens":3792,"output_tokens":686,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A '-98827':18A,21A '1':223C '13152':161C '15':310C '1500':324C '20':107C,138C,148C '20/20':327C '2292':142C '2296':149C '2304':137C,303C '32144':312C,314C '32768':119C,316C '4':283C,284C '45920':150C 'adapt':39B 'advanc':270C 'aggr':105C 'aggreg':50B,91C,139C 'alloc':56B,147C 'ath9k':3A,22B,30B,87C 'athero':34B 'attack':67B 'batch':123C,192C 'beyond':73B 'bound':89C,207C 'break':239C 'buf':95C,113C,117C,165C,166C,186C,228C,264C,272C 'buffer':12A,47B 'byte':43B,120C,131C,143C,151C,162C,206C 'chang':208C 'cnt':222C 'complet':204C,258C,296C 'copi':41B,178C 'corrupt':75B 'count':126C 'cross':183C 'cumul':130C 'current':191C 'cve':16A,19A 'dequeu':100C,253C 'dispatch':189C 'drain':199C 'driver':9A,32B 'drop':260C 'earli':238C 'everi':252C 'exceed':145C 'exit':212C,217C 'fi':8A,38B 'final':226C 'flood':304C 'follow':81C 'frame':15A,52B,108C,135C,140C,261C 'freed':256C 'hardwar':299C 'head':174C 'hif':97C 'hold':48B,244C 'htc':4A,23B,31B,88C 'ident':286C 'index':233C 'instead':276C 'kernel':2A,24B,58B,79C 'larg':14A,51B,134C 'last':232C,247C 'leftov':193C 'len':229C,234C,265C,282C,311C 'length':132C,250C 'limit':121C 'linux':1A,25B,78C 'loop':157C,210C,293C,306C 'make':262C 'max':93C,103C,115C,184C 'memcpi':154C 'memori':59B,74B 'mtu':136C,302C,323C 'never':128C 'next':202C 'nskb':281C 'num':106C 'offset':235C,273C,313C 'overflow':10A,72B 'overs':318C 'pass':326C 'past':54B,163C 'peek':171C 'per':274C 'ping':325C 'queu':196C 'queue':173C 'record':125C,180C,248C,275C,309C 'remain':195C 'resolv':85C 'round':279C 'run':267C,294C 'runtim':26B 'say':64B 'semant':213C 'silent':259C 'singl':111C 'size':96C,118C,187C 'skb':221C,254C 'skbs':194C 'sourc':61B 'stock':224C,289C 'stop':176C,307C 'stride':278C,290C 'submit':169C,241C,321C 'test':297C 'total':268C 'transmit':46B 'tx':11A,90C,94C,99C,104C,112C,116C,164C,185C,220C,227C,263C,271C 'urb':170C,203C,243C,319C 'usb':5A,27B,35B,98C,168C 'vulner':82C 'wi':7A,37B 'wi-fi':6A,36B 'wifi':28B,86C 'within':315C 'would':182C,240C 'write':53B,158C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the ath9k_htc driver and a USB Atheros Wi-Fi adapter, where large frames such as MTU 2304 are sent. Systems without this USB Wi-Fi hardware or driver are not affected. The sources do not say whether the flaw is reachable remotely.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:36+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98827","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98827","severity":null,"published_at":"2026-10-18T16:17:36+00:00","modified_at":"2026-10-19T10:19:46+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}