Cloudanix VulnDB

CVE-2026-68351

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A wireless driver in Linux could read more memory than intended when talking to its own hardware, which might leak data or cause crashes until the kernel is updated.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Unbounded memcpy in carl9170_cmd_callback copies more data than the destination readbuf was allocated for when firmware-supplied len exceeds ar->readlen, resulting in an out-of-bounds read.

Why it matters to the business

Potential information disclosure or system instability on affected wireless devices; low exploitability and no known active campaigns reduce immediate operational risk, though kernel updates remain necessary for long-term device security.

How an attack unfolds

An attacker would need to compromise or emulate the carl9170 firmware to send a command response packet whose reported length exceeds the expected buffer size, triggering the fall-through memcpy that reads past allocated memory.

How to fix it

Update to a Linux kernel containing the bound memcpy change (min(len-4, ar->readlen)) in the carl9170 driver; apply vendor-supplied kernel packages as they become available.

How to confirm the fix worked

Confirm the patched source contains the min() bound on the memcpy argument; test by sending oversized firmware responses in a controlled environment and verify no out-of-bounds access occurs.

Typical attack path

  1. Gain control of or emulate the wireless firmware to craft malicious command responses
  2. Trigger a length-mismatch condition in carl9170_cmd_callback
  3. Cause the unbounded memcpy to perform an out-of-bounds read
  4. Observe resulting memory disclosure or induce repeated device restarts

How to detect it

Review kernel logs for carl9170 length-mismatch messages followed by restarts; examine USB or wireless traffic captures for anomalous command response lengths from the firmware.

What your security team should do

  • Prioritize kernel updates for systems using carl9170 hardware once fixed packages are released
  • Monitor upstream Linux kernel changelogs for the specific carl9170 fix commit
  • Limit exposure by disabling the driver on systems where the hardware is not required

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read When the firmware sends a command response with a length mismatch, carl9170_cmd_callback() logs the mismatch and calls carl9170_restart() but then falls through to memcpy(ar->readbuf, buffer + 4, len - 4). Since len comes from the firmware and can exceed ar->readlen, this copies more data than the readbuf was allocated for. Bound the memcpy to min(len - 4, ar->readlen) so that the response is still completed -- avoiding repeated restarts from queued garbage -- while preventing an overread past the response buffer.

Affected packages

Ecosystem Package Introduced Fixed