In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k: Fix potential stack-out-of-bounds write in ath9kwmirsp_callback()
Fix a stack-out-of-bounds write that occurs in a WMI response callback function that is called after a timeout occurs in ath9kwmicmd(). The callback writes to wmi->cmdrspbuf, a stack-allocated buffer that could no longer be valid when a timeout occurs. Set wmi->lastseqid to 0 when a timeout occurred.
Found by a modified version of syzkaller.
BUG: KASAN: stack-out-of-bounds in ath9kwmictrlrx Write of size 4 Call Trace: memcpy ath9kwmictrlrx ath9khtcrxmsg ath9khifusbregincb _usbhcdgivebackurb usbhcdgivebackurb dummytimer calltimerfn runtimersoftirq _dosoftirq irqexitrcu sysvecapictimer_interrupt