Cloudanix VulnDB

CVE-2026-98827

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux driver for certain USB WiFi adapters can let specially crafted network traffic overflow memory and potentially crash or take control of the computer.

Exploitation
Adjacent Network
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Buffer overflow in ath9k_htc USB TX aggregation path where __hif_usb_tx dequeues frames without cumulative byte-length check against MAX_TX_BUF_SIZE, allowing memcpy to write up to 13152 bytes past the allocated tx_buf before usb_submit_urb.

Why it matters to the business

Systems using ath9k_htc WiFi adapters may experience kernel crashes, data corruption, or potential code execution leading to loss of availability or full system compromise, especially under high-MTU traffic loads.

How an attack unfolds

An attacker with the ability to induce or observe TX operations on vulnerable hardware triggers the driver to aggregate up to 20 large frames (MTU 2304) into a single USB URB, exceeding the 32768-byte buffer and causing an out-of-bounds write during the aggregation loop.

How to fix it

Apply the upstream kernel fix that adds a byte-length bound check before copying each record and maintains a running tx_buf->len total; rebuild and deploy the patched kernel on all affected systems.

How to confirm the fix worked

Confirm the presence of the byte-bound logic in __hif_usb_tx, re-test with an MTU 2304 flood to verify aggregation stops at or before 32768 bytes, and monitor for absence of oversized URB submissions or kernel warnings.

Typical attack path

  1. Locate a Linux system equipped with ath9k_htc USB WiFi hardware
  2. Generate or observe network conditions that produce multiple large frames exceeding MAX_TX_BUF_SIZE when batched
  3. Trigger __hif_usb_tx aggregation loop to perform unbounded memcpy into tx_buf
  4. Submit the oversized URB via usb_submit_urb to induce overflow

How to detect it

Review kernel logs and dmesg for ath9k_htc or __hif_usb_tx warnings, buffer-overrun indicators, or USB URB submission anomalies; correlate with high-volume large-frame TX activity on affected adapters.

  • __hif_usb_tx
  • ath9k_htc
  • MAX_TX_BUF_SIZE
  • usb_submit_urb oversized

What your security team should do

  • Prioritize kernel updates for any hosts using ath9k_htc hardware within the next patching cycle
  • Restrict MTU sizes or disable USB WiFi adapters where updates cannot be applied promptly
  • Add kernel crash and ath9k_htc driver logging to security monitoring

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE __hif_usb_tx() dequeues up to MAX_TX_AGGR_NUM (20) frames into a single tx_buf of MAX_TX_BUF_SIZE (32768) bytes, limiting the batch by record count but never by cumulative byte length. With large frames (MTU 2304), 20 aggregated frames of 2292 bytes each exceed the allocation (20 * 2296 = 45920 bytes), so the memcpy() in the loop writes up to 13152 bytes past tx_buf->buf before usb_submit_urb(). Peek the queue head and stop before copying any record that would cross MAX_TX_BUF_SIZE, then dispatch the current batch. Leftover skbs remain queued and are drained on the next URB completion. The byte bound changes the loop's exit semantics: it can now exit before i == tx_skb_cnt - 1. Stock only finalized tx_buf->len on that last index (len += offset), so an early break would submit a URB holding only the last record's length while every dequeued skb is freed on completion, silently dropping frames. Make tx_buf->len a running total and advance tx_buf->offset per record instead; the stride round_up(nskb->len + 4, 4) is identical to the stock stride when the loop runs to completion. Tested on hardware with an MTU 2304 flood: the loop stops at record 15 (len = 32144, offset = 32144, within 32768), no oversized URB is submitted, and MTU 1500 pings pass 20/20.

Affected packages

Ecosystem Package Introduced Fixed