{"id":"CVE-2026-98828","kind":"vulnerability","aliases":["CVE-2026-98828"],"related":[],"title":"Linux kernel ath9k WiFi driver over-reads short WMI responses from device","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k: reject short WMI command responses\n\nath9k_wmi_rsp_callback() removes the validated WMI header and copies\nthe number of bytes expected by the waiting command into its response\nbuffer. A device response shorter than that expectation can therefore\nbe read beyond the skb payload.\n\nRecord -EMSGSIZE for a short response, complete the waiter, and return\nthe stored status from the command path. This also prevents callers from\nconsuming stale response bytes as a successful reply.","summary":"The Linux kernel's ath9k Wi-Fi driver copies more bytes than a device response contains when the response is shorter than the waiting command expects, reading past the packet buffer. The fix rejects short responses with -EMSGSIZE so callers do not consume stale bytes.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ath9k","infrastructure","kernel","linux","wifi"],"not_affected_if":["no-ath9k-hardware"],"how_to_check":"- Run `uname -r` and check whether the running kernel includes the ath9k fix for short WMI responses in its version notes.\n- Run `lsmod | grep ath9k` to see whether the ath9k driver is loaded on the machine.","fix":"- Update the Linux kernel to a release that includes the upstream commit 'wifi: ath9k: reject short WMI command responses' (exact version unknown from sources).\n- Until patched, unload the driver with `modprobe -r ath9k` where Wi-Fi hardware is not needed.","status":"open","published_at":"2026-10-18T16:17:37+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:14:38+00:00","updated_at":"2026-10-25T05:14:38+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T05:14:38Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit 'wifi: ath9k: reject short WMI command responses' (exact version unknown from sources).\n- Until patched, unload the driver with `modprobe -r ath9k` where Wi-Fi hardware is not needed.","reach":"local","title":"Linux kernel ath9k WiFi driver over-reads short WMI responses from device","impact":"low","summary":"The Linux kernel's ath9k Wi-Fi driver copies more bytes than a device response contains when the response is shorter than the waiting command expects, reading past the packet buffer. The fix rejects short responses with -EMSGSIZE so callers do not consume stale bytes.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","wifi","ath9k"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Kernel reads beyond packet buffer, possibly leaking memory contents","analyst_note":"Check the NVD entry and the upstream kernel commit for affected version ranges, the attack vector and whether a malicious device or remote Wi-Fi frame can trigger the short response.","how_to_check":"- Run `uname -r` and check whether the running kernel includes the ath9k fix for short WMI responses in its version notes.\n- Run `lsmod | grep ath9k` to see whether the ath9k driver is loaded on the machine.","needs_analyst":true,"not_affected_if":["no-ath9k-hardware"],"who_is_affected":"Affected systems are Linux machines running the ath9k driver for Atheros Wi-Fi adapters, which is the device path where the kernel receives WMI responses from the hardware. Servers and machines without ath9k-based Wi-Fi hardware can skip it. Sources do not state the affected kernel version range.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000673,"input_tokens":3394,"output_tokens":668,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-98828':16A,19A 'also':146C 'ath9k':3A,20B,29B,82C,88C 'beyond':123C 'buffer':56B,111C 'byte':36B,70B,102C,153C 'callback':91C 'caller':65B,148C 'command':50B,86C,107C,143C 'complet':133C 'consum':68B,150C 'contain':41B 'copi':34B,98C 'cve':14A,17A 'devic':13A,39B,113C 'driver':5A,33B 'emsgsiz':63B,128C 'expect':51B,103C,118C 'fi':32B 'fix':58B 'follow':76C 'header':96C 'infrastructur':21B 'kernel':2A,22B,27B,74C 'linux':1A,23B,26B,73C 'number':100C 'over-read':6A 'packet':55B 'past':53B 'path':144C 'payload':126C 'prevent':147C 'read':8A,52B,122C 'record':127C 'reject':59B,83C 'remov':92C 'repli':157C 'resolv':80C 'respons':11A,40B,44B,61B,87C,110C,114C,132C,152C 'return':137C 'rsp':90C 'short':9A,60B,84C,131C 'shorter':46B,115C 'skb':125C 'stale':69B,151C 'status':140C 'store':139C 'success':156C 'therefor':120C 'valid':94C 'vulner':77C 'wait':49B,106C 'waiter':135C 'wi':31B 'wi-fi':30B 'wifi':4A,24B,81C 'wmi':10A,85C,89C,95C","nicknames":[],"mitigations":[],"who_affected":"Affected systems are Linux machines running the ath9k driver for Atheros Wi-Fi adapters, which is the device path where the kernel receives WMI responses from the hardware. Servers and machines without ath9k-based Wi-Fi hardware can skip it. Sources do not state the affected kernel version range.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:37+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98828","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98828","severity":null,"published_at":"2026-10-18T16:17:37+00:00","modified_at":"2026-10-19T10:19:46+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}