CVE-2026-68350
Received Received - Intake

Buffer Overflow in Linux Kernel WiFi Driver

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: fix OOB read from off-by-two in TX status handler The bounds check in carl9170_tx_process_status() uses `i > ((cmd->hdr.len / 2) + 1)` which is off by two, allowing 2 extra iterations past valid _tx_status entries when the firmware- controlled hdr.ext exceeds hdr.len/2. Fix by using the correct comparison `i >= (cmd->hdr.len / 2)`.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68350
EUVD
EUVD-2026-55451

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel carl9170 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a vulnerability in the Linux kernel's carl9170 Wi-Fi driver. It involves an out-of-bounds (OOB) read caused by an off-by-two error in the TX status handler. The bounds check incorrectly allows two extra iterations past valid entries, potentially exposing memory beyond intended limits.

Detection Guidance

This vulnerability is specific to the Linux kernel's carl9170 WiFi driver and involves an out-of-bounds read in the TX status handler. Detection requires checking for kernel logs or driver errors related to carl9170 or WiFi TX status processing. Commands like dmesg | grep carl9170 or journalctl -k | grep carl9170 may help identify issues.

Impact Analysis

An attacker within Wi-Fi range could exploit this to read sensitive kernel memory, leading to information disclosure or system crashes. It primarily affects systems using the carl9170 Wi-Fi driver.

Mitigation Strategies

Update your Linux kernel to the latest patched version that includes the fix for CVE-2026-68350. If using a distribution kernel, apply available security updates. For custom kernels, ensure the patch for the carl9170 driver is applied and rebuild.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68350. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart