In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: reject short WMI command responses ath9k_wmi_rsp_callback() removes… (CVE-2026-98828)

The vulnerability in the Linux kernel's ath9k driver arises from the ath9k_wmi_rsp_callback() function removing the validated WMI header and copying the expected number of bytes into the response buffer. If the device response is shorter than expected, this can cause out-of-bounds reads beyond the skb payload. The patch addresses this by recording an -EMSGSIZE error for short responses, completing the waiting command, and returning the stored status to prevent consumption of stale response bytes.

This vulnerability could lead to out-of-bounds reads in kernel memory when processing short WMI command responses in the ath9k wireless driver. Such memory safety issues may cause kernel instability or potentially be leveraged for further exploitation, though no exploits are known in the wild.

A fix has been implemented in the Linux kernel to handle short WMI command responses correctly by recording an error and preventing stale data consumption. Users should update to the fixed Linux kernel version containing this patch. No additional mitigations are indicated.