Live › vulnerability › CVE-2026-98828
Go to dashboardThe Linux kernel's ath9k Wi-Fi driver copies more bytes than a device response contains when the response is shorter than the waiting command expects, reading past the packet buffer. The fix rejects short responses with -EMSGSIZE so callers do not consume stale bytes.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Affected systems are Linux machines running the ath9k driver for Atheros Wi-Fi adapters, which is the device path where the kernel receives WMI responses from the hardware. Servers and machines without ath9k-based Wi-Fi hardware can skip it. Sources do not state the affected kernel version range.
No product ranges from the sources yet.
uname -r and check whether the running kernel includes the ath9k fix for short WMI responses in its version notes.lsmod | grep ath9k to see whether the ath9k driver is loaded on the machine.modprobe -r ath9k where Wi-Fi hardware is not needed.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k: reject short WMI command responses
ath9k_wmi_rsp_callback() removes the validated WMI header and copies the number of bytes expected by the waiting command into its response buffer. A device response shorter than that expectation can therefore be read beyond the skb payload.
Record -EMSGSIZE for a short response, complete the waiter, and return the stored status from the command path. This also prevents callers from consuming stale response bytes as a successful reply.
This page as .md · .json · in your agent: get_signal("CVE-2026-98828")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.