The ath9k Wi‑Fi driver in the Linux kernel mishandles short WMI command responses. The routine copies the expected number of bytes into a response buffer without checking that the incoming packet actually contains that many bytes. When an attacker sends a truncated response, the driver reads beyond the skb payload, producing an out‑of‑bounds read (CWE‑125). This can leak kernel memory contents and may be used to gather sensitive information about the system.

The flaw is present in the ath9k driver shipped with stock Linux kernels. All releases of the kernel that have not been updated to the latest stable version containing the patch (commit 03ef61d0…) are affected. Because no specific kernel versions are enumerated, any system running an unpatched kernel is potentially vulnerable.

The vulnerability is in kernel space, so exploitation requires the attacker to inject crafted frames to the wireless interface, which is feasible for a device connected to the victim’s Wi‑Fi network or a local attacker with privileged access to the network device. The EPSS score is < 1% and the defect is not listed in the CISA KEV catalog, yet the potential for kernel memory disclosure and the lack of a hardening countermeasure make the risk significant. The CVSS score of 6.2 indicates medium severity, so until the kernel is updated, the flaw should be treated as medium‑severity, especially on production systems that depend on ath9k.