CVE-2026-68351

Received Received - Intake

Out-of-Bounds Read in Linux Kernel's carl9170 WiFi Driver

Publication date: 2026-08-10

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read When the firmware sends a command response with a length mismatch, carl9170_cmd_callback() logs the mismatch and calls carl9170_restart() but then falls through to memcpy(ar->readbuf, buffer + 4, len - 4). Since len comes from the firmware and can exceed ar->readlen, this copies more data than the readbuf was allocated for. Bound the memcpy to min(len - 4, ar->readlen) so that the response is still completed -- avoiding repeated restarts from queued garbage -- while preventing an overread past the response buffer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-19

Generated

2026-08-30

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68351

EUVD

EUVD-2026-55452

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	carl9170	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a buffer over-read vulnerability in the Linux kernel's carl9170 Wi-Fi driver. When the firmware sends a command response with an incorrect length, the driver's callback function attempts to copy more data than the allocated buffer can hold. This happens because the memcpy operation uses a length value from the firmware without proper bounds checking.

Detection Guidance

This vulnerability affects the Linux kernel's carl9170 WiFi driver and may lead to out-of-bounds reads. Detection requires checking kernel logs for firmware command response mismatches or driver crashes. Monitor logs with 'dmesg | grep carl9170' or 'journalctl -k | grep carl9170' for errors.

Impact Analysis

An attacker on the same Wi-Fi network could potentially exploit this to read sensitive kernel memory, leading to information disclosure. This might allow access to passwords, encryption keys, or other confidential data processed by the system.

Compliance Impact

This vulnerability is a buffer over-read in the Linux kernel's wifi driver (carl9170) that could allow unauthorized memory access. While it does not directly impact GDPR or HIPAA compliance, such vulnerabilities could potentially lead to data exposure or unauthorized access, which may violate these regulations if exploited.

Mitigation Strategies

Update your Linux kernel to the latest patched version. If using a custom or older kernel, apply the upstream patch for CVE-2026-68351. Disable the carl9170 driver if not required by running 'modprobe -r carl9170' and blacklisting it.

Hi! I’m here to help you understand CVE-2026-68351. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70