CVE-2026-68350wifi: carl9170: fix OOB read from off-by-two in TX status handler
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: fix OOB read from off-by-two in TX status handler The bounds check in carl9170_tx_process_status() uses `i > ((cmd->hdr.len / 2) + 1)` which is off by two, allowing 2 extra iterations past valid _tx_status entries when the firmware- controlled hdr.ext exceeds hdr.len/2. Fix by using the correct comparison `i >= (cmd->hdr.len / 2)`.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from a84fab3cbfdc427e7d366f1cc844f27b2084c26c before 9bf8d8510b7bed20320dead0f8cdcf8e610ec8db; from a84fab3cbfdc427e7d366f1cc844f27b2084c26c before 2c030c20f112bd8f6aa59d09501835605f01bf9d; from a84fab3cbfdc427e7d366f1cc844f27b2084c26c before 73462e8e602047a03e538d971a79ad67a4ba9a5d; from a84fab3cbfdc427e7d366f1cc844f27b2084c26c before 7ed0dce8613c92111d2a3836ced2ab03190ba20e; from a84fab3cbfdc427e7d366f1cc844f27b2084c26c before e8a862a3da457ddc50633c346dc645d559da09ae; from a84fab3cbfdc427e7d366f1cc844f27b2084c26c before fab6ff91d5b8c4af62e2ced42fb357fa3eb9fd59; from a84fab3cbfdc427e7d366f1cc844f27b2084c26c before 423c836f934814b8fdbe53b24a79d021a0ee8454; from a84fab3cbfdc427e7d366f1cc844f27b2084c26c before a3f42f1049ad80c65560d2b078ad426c3134f78d | CNA record |
References
- https://git.kernel.org/stable/c/9bf8d8510b7bed20320dead0f8cdcf8e610ec8db
- https://git.kernel.org/stable/c/2c030c20f112bd8f6aa59d09501835605f01bf9d
- https://git.kernel.org/stable/c/73462e8e602047a03e538d971a79ad67a4ba9a5d
- https://git.kernel.org/stable/c/7ed0dce8613c92111d2a3836ced2ab03190ba20e
- https://git.kernel.org/stable/c/e8a862a3da457ddc50633c346dc645d559da09ae
- https://git.kernel.org/stable/c/fab6ff91d5b8c4af62e2ced42fb357fa3eb9fd59
- https://git.kernel.org/stable/c/423c836f934814b8fdbe53b24a79d021a0ee8454
- https://git.kernel.org/stable/c/a3f42f1049ad80c65560d2b078ad426c3134f78d
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.