SB20261022447 - Out-of-bounds read in Linux kernel ath ath9k driver

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds read (CVE-ID: CVE-2026-98828)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an out-of-bounds read that may disclose sensitive information or cause a denial of service.

The vulnerability exists due to an out-of-bounds read in ath9k_wmi_rsp_callback() when processing a WMI command response shorter than the expected response length. A local user can supply a truncated response, if able to control device responses, to cause the kernel to copy bytes beyond the socket buffer payload into the waiting command's response buffer.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/03ef61d05aa26022327f971b790f07e6bf6e35d6
• https://git.kernel.org/stable/c/93ce8ea70451e800601bc9444aa33043de15d67b
• https://git.kernel.org/stable/c/a3b0137c855a61371d9cf9993b8bcc33c9798202
• https://git.kernel.org/stable/c/e0c21130c1c7791ba73b19a3a9ea767c8cd43745