From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BA57D3290B9 for ; Sun, 18 Oct 2026 16:21:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792340484; cv=none; b=pyEG5FvKoehDrGMW9MJ0TCOaZQdWs+3pSj6Xsf4L2uN8KY0hm35JmEylEY6VB9pdOU3rTneYUQLrN1WKf2AJ1Q2C8UaafLI/HcjacqRu00GOfaKOCcWhucMJOLSLOpkg/Z8PhhSljhHxtYcJQ61yhf6rbUeb1F+822Yh7E8OEhE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792340484; c=relaxed/simple; bh=7IpN6yL0r88noLm50MTH6IjTCiDc615N99YOKHk6+uU=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=RDp+p7QFh78PkbFoXM09rXNbxzAmrzUVxUk8grn3sjWILMjurnc9gd1Hncl69oa5LK0IwCz36LK3E22XKDMZR9xXrrX+sB3UINEV7nLjaFgCE/avD38+wkyZdvF3ulz1tLDcKewbU5z/mHu9KebI6/IAHA9UX501cMVBq+iH8mQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=FoQql+rR; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="FoQql+rR" Received: by smtp.kernel.org (Postfix) with ESMTPSA id CB89E1F000C4; Sun, 18 Oct 2026 16:21:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1792340483; bh=D2LfEwiVr37L2sNAR3w3D7WCjjYtMWEGq8a4twrN6RE=; h=From:To:Cc:Subject:Date:Reply-To; b=FoQql+rR2K1GwOiCK/lAY1BOirJL+rOAWbe7ylCGbhjKCPHLikgywdBnNJv7ooRyX PWxUnOhU4QWI3taxHvntBH/Ha8aQwMwZ/CLB/xWVYVS7cq22PxESQYUX+uNpjtpB5R rvuc/Jwm7t0dSs0ZtyxZHG+wYSq9Afktdpb/tsnQ= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-98827: wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE Date: Sun, 18 Oct 2026 17:46:42 +0200 Message-ID: <2026101830-CVE-2026-98827-0ebf@gregkh> X-Mailer: git-send-email 2.56.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3546; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=yeojj1tPYxAietVe5IDLyfPgDhl1QIdugiKgUpRFAuM=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlXXsZ5rKm8uWRLrVS4X43s9JkMneckHpX3PL85a19ks 8Lubw2fO2JZGASZGGTFFFm+bOM5ur/ikKKXoe1pmDmsTCBDGLg4BWAiVXsZ5vue/WgQwm1Wbcdx 4M9fCbk6MaEnDQzzq4RlKmZciJYSOHUwJj6l0F6P84sBAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE __hif_usb_tx() dequeues up to MAX_TX_AGGR_NUM (20) frames into a single tx_buf of MAX_TX_BUF_SIZE (32768) bytes, limiting the batch by record count but never by cumulative byte length. With large frames (MTU 2304), 20 aggregated frames of 2292 bytes each exceed the allocation (20 * 2296 = 45920 bytes), so the memcpy() in the loop writes up to 13152 bytes past tx_buf->buf before usb_submit_urb(). Peek the queue head and stop before copying any record that would cross MAX_TX_BUF_SIZE, then dispatch the current batch. Leftover skbs remain queued and are drained on the next URB completion. The byte bound changes the loop's exit semantics: it can now exit before i == tx_skb_cnt - 1. Stock only finalized tx_buf->len on that last index (len += offset), so an early break would submit a URB holding only the last record's length while every dequeued skb is freed on completion, silently dropping frames. Make tx_buf->len a running total and advance tx_buf->offset per record instead; the stride round_up(nskb->len + 4, 4) is identical to the stock stride when the loop runs to completion. Tested on hardware with an MTU 2304 flood: the loop stops at record 15 (len = 32144, offset = 32144, within 32768), no oversized URB is submitted, and MTU 1500 pings pass 20/20. The Linux kernel CVE team has assigned CVE-2026-98827 to this issue. Affected and fixed versions =========================== Issue introduced in 2.6.35 with commit fb9987d0f748c983bb795a86f47522313f701a08 and fixed in 6.12.113 with commit c18882768a0fe253c70986c5fe66d9241570fbc4 Issue introduced in 2.6.35 with commit fb9987d0f748c983bb795a86f47522313f701a08 and fixed in 6.18.56 with commit 345ce265cf604e84b5b560c21beaf4c6f269ab14 Issue introduced in 2.6.35 with commit fb9987d0f748c983bb795a86f47522313f701a08 and fixed in 7.2.10 with commit e73a619f91b6cfec47bc1a94aea28df6849e5be3 Issue introduced in 2.6.35 with commit fb9987d0f748c983bb795a86f47522313f701a08 and fixed in 7.3-rc6 with commit aeaca27c1db3106967ffbb2b517d98c835f6d500 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-98827 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/wireless/ath/ath9k/hif_usb.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/c18882768a0fe253c70986c5fe66d9241570fbc4 https://git.kernel.org/stable/c/345ce265cf604e84b5b560c21beaf4c6f269ab14 https://git.kernel.org/stable/c/e73a619f91b6cfec47bc1a94aea28df6849e5be3 https://git.kernel.org/stable/c/aeaca27c1db3106967ffbb2b517d98c835f6d500