In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE __hif_usb_tx() dequeues… (CVE-2026-98827)

The Linux kernel's ath9k_htc wifi driver had a vulnerability where the __hif_usb_tx() function dequeued up to MAX_TX_AGGR_NUM (20) frames into a single transmit buffer of MAX_TX_BUF_SIZE (32768 bytes) without limiting the total byte length. With large frames (MTU 2304), this caused memcpy() to write up to 13152 bytes beyond the allocated buffer, leading to a buffer overflow. The fix bounds the aggregation by cumulative byte length, stopping the dequeue loop before exceeding the buffer size, and adjusts the transmit buffer length accounting to prevent frame loss. Testing confirmed no oversized URBs are submitted and normal operation with large MTU frames.

The vulnerability could cause memory corruption due to buffer overflow in the wifi driver, potentially leading to system instability or crashes. Additionally, frames could be silently dropped due to incorrect transmit buffer length handling, impacting network reliability. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to bound TX aggregation by the maximum transmit buffer size and correctly manage transmit buffer length. Users should apply the official Linux kernel updates that include this fix. No additional mitigation is required beyond applying the patch.