Cloudanix VulnDB

CVE-2026-68349

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A programming mistake in a specific wireless network driver can cause certain Linux computers to crash when handling network traffic.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Incorrect copy length in carl9170_rx_stream() failover path copies full tlen instead of rx_failover_missing bytes, overflowing the 65535-byte failover SKB and causing skb_over_panic.

Why it matters to the business

Potential kernel panic and system crash on affected Linux devices using the carl9170 USB Wi-Fi adapter under specific USB transfer conditions; low exploitability reduces immediate operational risk.

How an attack unfolds

An attacker with the ability to influence USB transfers to the carl9170 device sends two near-maximum-size transfers that trigger the failover continuation, exceeding the SKB limit and panicking the kernel.

How to fix it

Apply the upstream kernel patch that limits the copy size to rx_failover_missing bytes; rebuild and deploy updated kernel images to affected systems.

How to confirm the fix worked

Confirm the patch is present by inspecting carl9170_rx_stream() for the capped copy; test with maximum-size transfer sequences that previously triggered failover.

Typical attack path

  1. Gain ability to deliver crafted or oversized USB transfers to carl9170 device
  2. Trigger rx_stream failover path with two large transfers
  3. Cause copy of full tlen exceeding rx_failover_missing bytes
  4. Overflow failover SKB and trigger skb_over_panic

How to detect it

Review kernel logs for skb_over_panic or carl9170-related oops messages; correlate with USB transfer activity on affected hardware.

What your security team should do

  • Prioritize kernel updates for systems using carl9170 hardware
  • Monitor kernel logs for skb_over_panic entries
  • Consider disabling the adapter if updates cannot be applied promptly

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: fix buffer overflow in rx_stream failover path The failover continuation in carl9170_rx_stream() copies the full tlen from the second USB transfer instead of capping at rx_failover_missing bytes. When both transfers are near maximum size, the total exceeds the 65535-byte failover SKB, triggering skb_over_panic. Limit the copy size to the missing byte count. [Fix checkpatch CHECK:PARENTHESIS_ALIGNMENT]

Affected packages

Ecosystem Package Introduced Fixed