Linux Kernel Vulnerability in ath9k Affecting Wi-Fi Devices

CVE-2026-98828

What is CVE-2026-98828?

A vulnerability exists in the Linux kernel's ath9k driver that affects Wi-Fi devices handling WMI command responses. This issue occurs when the ath9k_wmi_rsp_callback() function removes the validated WMI header and may end up reading more bytes than expected from a device response that is shorter than anticipated. As a result, this could allow for the reading of bytes beyond the intended skb payload, potentially leading to the exposure of stale data. The resolution involves properly managing message sizes by returning an error when a short response is detected, thus preventing unintended access to incorrect data.

References