The ath9k_htc Wi‑Fi driver in the Linux kernel aggregates up to 20 frames into a fixed 32 KB buffer without verifying the cumulative size. When large frames of 2,300 bytes are queued, the driver may copy more data than the buffer holds, writing up to 13 KB beyond the allocated buffer. This out‑of‑bounds memcpy corrupts kernel memory, which could be leveraged by an attacker to crash the system, overwrite control data, or potentially gain elevated privileges if they can control the overwritten contents.

All Linux systems that load the ath9k_htc driver from a kernel that lacks the commit patching the aggregation logic are affected. The flaw is present across the default ath9k_htc driver included in all mainline kernels before the fix, notably on hardware using Qualcomm Atheros wireless adapters.

The flaw is not listed in the CISA KEV catalog, and the EPSS score indicates a very low exploitation probability (<1%). The likely attack vector is a local user or code that can influence transmitted frames, such as by generating large packets that exceed the MTU or by sending malicious traffic that triggers the driver to aggregate many large frames. Because the memory corruption occurs in kernel space, use of the overflow could lead to a denial of service or, if an attacker can control the overwritten memory, privilege escalation. The risk is high for installations that have not applied the patch, but exploitation would typically require local or privileged access to the driver context.