---
id: CVE-2026-98828
title: 'wifi: ath9k: reject short WMI command responses'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: ath9k: reject short WMI command responses

  ath9k_wmi_rsp_callback() removes the validated WMI header and copies
  the number of bytes expected by the waiting comman…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= fb9987d0f748c983bb795a86f47522313f701a08 <
    03ef61d05aa26022327f971b790f07e6bf6e35d6
  - >-
    Linux >= fb9987d0f748c983bb795a86f47522313f701a08 <
    e0c21130c1c7791ba73b19a3a9ea767c8cd43745
  - >-
    Linux >= fb9987d0f748c983bb795a86f47522313f701a08 <
    a3b0137c855a61371d9cf9993b8bcc33c9798202
  - >-
    Linux >= fb9987d0f748c983bb795a86f47522313f701a08 <
    93ce8ea70451e800601bc9444aa33043de15d67b
  - Linux 2.6.35
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:49:22.580Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98828'
references:
  - url: 'https://git.kernel.org/stable/c/03ef61d05aa26022327f971b790f07e6bf6e35d6'
  - url: 'https://git.kernel.org/stable/c/e0c21130c1c7791ba73b19a3a9ea767c8cd43745'
  - url: 'https://git.kernel.org/stable/c/a3b0137c855a61371d9cf9993b8bcc33c9798202'
  - url: 'https://git.kernel.org/stable/c/93ce8ea70451e800601bc9444aa33043de15d67b'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.472Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath9k: reject short WMI command responses

ath9k_wmi_rsp_callback() removes the validated WMI header and copies
the number of bytes expected by the waiting command into its response
buffer. A device response shorter than that expectation can therefore
be read beyond the skb payload.

Record -EMSGSIZE for a short response, complete the waiter, and return
the stored status from the command path. This also prevents callers from
consuming stale response bytes as a successful reply.

## Affected

- `Linux >= fb9987d0f748c983bb795a86f47522313f701a08 < 03ef61d05aa26022327f971b790f07e6bf6e35d6`
- `Linux >= fb9987d0f748c983bb795a86f47522313f701a08 < e0c21130c1c7791ba73b19a3a9ea767c8cd43745`
- `Linux >= fb9987d0f748c983bb795a86f47522313f701a08 < a3b0137c855a61371d9cf9993b8bcc33c9798202`
- `Linux >= fb9987d0f748c983bb795a86f47522313f701a08 < 93ce8ea70451e800601bc9444aa33043de15d67b`
- `Linux 2.6.35`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.