An out‑of‑bounds array access flaw was found in the ath9k wireless driver. The function ath_tx_edma_tasklet() indexes sc->tx.txq with the field ts.qid, a 4‑bit hardware value that can be 0–15. The txq array provides only ten entries, so a qid value greater than nine causes an out‑of‑bounds read/write on kernel memory. This can corrupt adjacent memory, potentially leading to a kernel crash or, if an attacker is able to influence the queue id, arbitrary code execution.

The vulnerability affects Linux systems that use the ath9k Wi‑Fi driver. No specific kernel release numbers are listed in the advisory; the flaw exists in any kernel build that contains the ath9k driver prior to the patch that introduces the bounds check.

The advisory lists a CVSS score of 8.8 and an EPSS score of <1%, and the flaw is not in the CISA KEV catalog. Because the exploit requires the driver to process a firmware transmission status report with a manipulated queue id, the attack surface is limited to systems exposing the ath9k interface. If an attacker can send crafted packets that trigger the faulty tx status path, the out‑of‑bounds access could be leveraged to corrupt memory and potentially execute code. The risk is therefore moderate to high in environments where the ath9k driver is actively used and cannot be isolated or disabled.