CVE-2026-98827

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE

__hif_usb_tx() dequeues up to MAX_TX_AGGR_NUM (20) frames into a

single tx_buf of MAX_TX_BUF_SIZE (32768) bytes, limiting the batch

by record count but never by cumulative byte length.

With large frames (MTU 2304), 20 aggregated frames of 2292 bytes

each exceed the allocation (20 * 2296 = 45920 bytes), so the

memcpy() in the loop writes up to 13152 bytes past tx_buf->buf

before usb_submit_urb().

Peek the queue head and stop before copying any record that would

cross MAX_TX_BUF_SIZE, then dispatch the current batch. Leftover

skbs remain queued and are drained on the next URB completion.

The byte bound changes the loop's exit semantics: it can now exit

before i == tx_skb_cnt - 1. Stock only finalized tx_buf->len on

that last index (len += offset), so an early break would submit a

URB holding only the last record's length while every dequeued skb

is freed on co

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References