---
id: "CVE-2026-98828"
kind: "vulnerability"
aliases: ["CVE-2026-98828"]
title: "Linux kernel ath9k WiFi driver over-reads short WMI responses from device"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["ath9k", "infrastructure", "kernel", "linux", "wifi"]
not_affected_if: ["no-ath9k-hardware"]
published_at: "2026-10-18T16:17:37+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T05:14:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98828", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# Linux kernel ath9k WiFi driver over-reads short WMI responses from device

The Linux kernel's ath9k Wi-Fi driver copies more bytes than a device response contains when the response is shorter than the waiting command expects, reading past the packet buffer. The fix rejects short responses with -EMSGSIZE so callers do not consume stale bytes.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `uname -r` and check whether the running kernel includes the ath9k fix for short WMI responses in its version notes.
- Run `lsmod | grep ath9k` to see whether the ath9k driver is loaded on the machine.

## Fix

- Update the Linux kernel to a release that includes the upstream commit 'wifi: ath9k: reject short WMI command responses' (exact version unknown from sources).
- Until patched, unload the driver with `modprobe -r ath9k` where Wi-Fi hardware is not needed.

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98828

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath9k: reject short WMI command responses

ath9k_wmi_rsp_callback() removes the validated WMI header and copies
the number of bytes expected by the waiting command into its response
buffer. A device response shorter than that expectation can therefore
be read beyond the skb payload.

Record -EMSGSIZE for a short response, complete the waiter, and return
the stored status from the command path. This also prevents callers from
consuming stale response bytes as a successful reply.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_