CVE-2026-68350

What it actually does

Off-by-two bounds check in carl9170_tx_process_status allows two extra loop iterations past valid _tx_status entries when hdr.ext exceeds hdr.len/2, resulting in out-of-bounds read from the firmware-controlled command buffer.

Why it matters to the business

Kernel memory corruption risk in wireless drivers can lead to system instability, information disclosure, or crashes on affected Linux systems using carl9170 hardware, with moderate operational disruption due to low exploit maturity and no known active campaigns.

How an attack unfolds

An attacker with control over the firmware interface or a malicious USB device sends crafted TX status commands where hdr.len and hdr.ext are manipulated; the flawed comparison permits reads beyond the intended status array, potentially leaking kernel memory or triggering faults.

How to fix it

Apply the upstream kernel patch correcting the comparison to `i >= (cmd->hdr.len / 2)` or update to a kernel release containing the fix; rebuild and reboot affected systems.

How to confirm the fix worked

Inspect the source of carl9170_tx_process_status for the corrected bounds check; verify kernel version includes the commit resolving the off-by-two error; run regression tests exercising TX status paths.

Typical attack path

1. Attach or emulate carl9170-compatible device
2. Deliver TX status command with hdr.len/2 < hdr.ext
3. Trigger carl9170_tx_process_status processing
4. Read or corrupt adjacent kernel structures via OOB access

How to detect it

Review kernel logs for oops, slab-out-of-bounds warnings, or carl9170 driver faults around TX status handling; correlate with USB device insertion events.

What your security team should do

• Prioritize kernel updates on systems exposing wireless interfaces
• Monitor for related driver oops or memory warnings
• Limit use of carl9170 hardware until patched