{"id":"AZL-109304","summary":"CVE-2026-98828 affecting package kernel 6.6.157.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k: reject short WMI command responses\n\nath9k_wmi_rsp_callback() removes the validated WMI header and copies\nthe number of bytes expected by the waiting command into its response\nbuffer. A device response shorter than that expectation can therefore\nbe read beyond the skb payload.\n\nRecord -EMSGSIZE for a short response, complete the waiter, and return\nthe stored status from the command path. This also prevents callers from\nconsuming stale response bytes as a successful reply.","modified":"2026-10-19T14:17:06.023965102Z","published":"2026-10-18T16:17:37Z","upstream":["CVE-2026-98828"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98828"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.157.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-109304.json"}}],"schema_version":"1.9.0"}