{
  "cveId": "CVE-2026-98827",
  "url": "https://patchblox.com/security/cve/CVE-2026-98827",
  "summary": "CVE-2026-98827 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2026-98827, released October 19, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE  __hif_usb_tx() dequeues up to MAX_TX_AGGR_NUM (20) frames into a single tx_buf of MAX_TX_BUF_SIZE (32768) bytes, limiting the batch by record count but never by cumulative byte length.  With large frames (MTU 2304), 20 aggregated frames of 2292 bytes each exceed the allocation (20 * 2296 = 45920 bytes), so the memcpy() in the loop writes up to 13152 bytes past tx_buf-\u003Ebuf before usb_submit_urb().  Peek the queue head and stop before copying any record that would cross MAX_TX_BUF_SIZE, then dispatch the current batch. Leftover skbs remain queued and are drained on the next URB completion.  The byte bound changes the loop\u0027s exit semantics: it can now exit before i == tx_skb_cnt - 1. Stock only finalized tx_buf-\u003Elen on that last index (len \u002B= offset), so an early break would submit a URB holding only the last record\u0027s length while every dequeued skb is freed on completion, silently dropping frames. Make tx_buf-\u003Elen a running total and advance tx_buf-\u003Eoffset per record instead; the stride round_up(nskb-\u003Elen \u002B 4, 4) is identical to the stock stride when the loop runs to completion.  Tested on hardware with an MTU 2304 flood: the loop stops at record 15 (len = 32144, offset = 32144, within 32768), no oversized URB is submitted, and MTU 1500 pings pass 20/20.",
  "published": "2026-10-18T16:17:36Z",
  "severity": "Important",
  "cvss": 7.1,
  "epss": 0.002,
  "epssPercentile": 0.09885,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-98827",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.113-1",
      "fix": "DEBIAN-CVE-2026-98827",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-98827",
      "released": "2026-10-19T16:27:52Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.10-1",
      "fix": "DEBIAN-CVE-2026-98827",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-98827",
      "released": "2026-10-19T16:27:52Z"
    },
    {
      "platform": "linux",
      "product": "linux-6.12",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.12.113-1~deb12u1",
      "fix": "DEBIAN-CVE-2026-98827",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-98827",
      "released": "2026-10-19T16:27:52Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T13:31:49Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}