CVE-2026-98828

What it actually does

Out-of-bounds read in ath9k_wmi_rsp_callback when a WMI device response is shorter than the expected length, allowing the driver to copy bytes past the end of the skb payload into a waiting command buffer.

Why it matters to the business

Kernel memory corruption or information disclosure on systems using ath9k wireless hardware, potentially leading to crashes, privilege escalation, or data leaks; low immediate risk given recent publication and minimal exploit activity.

How an attack unfolds

An attacker with the ability to supply crafted WMI responses from the wireless device (via compromised firmware or malicious hardware) triggers the short-response path, causing the callback to read beyond allocated skb data and potentially corrupt or leak kernel memory during command completion.

How to fix it

Update to a Linux kernel containing the fix that rejects short WMI responses with -EMSGSIZE; apply the latest stable kernel for the distribution as soon as available.

How to confirm the fix worked

Confirm the patch is present by inspecting ath9k_wmi.c for the short-response length check and -EMSGSIZE return; test with a device that can generate undersized WMI replies and verify the command path now returns the stored error instead of consuming stale data.

Typical attack path

1. Gain control of ath9k wireless device firmware or attach malicious hardware
2. Send a WMI command that expects a longer response than the device returns
3. Trigger ath9k_wmi_rsp_callback to perform the oversized copy from the short skb
4. Observe or exploit resulting kernel memory state for further attack steps

How to detect it

Review kernel logs for ath9k or WMI-related errors around command timeouts or size mismatches; look for unexpected crashes in the wireless driver stack or use of memory debugging tools that flag out-of-bounds accesses.

What your security team should do

• Prioritize kernel updates on systems with ath9k hardware within normal patching cycles
• Monitor upstream Linux kernel changelogs for ath9k-related commits
• Disable ath9k modules on high-risk systems until patched if hardware is not required