CVE-2026-68351wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read When the firmware sends a command response with a length mismatch, carl9170_cmd_callback() logs the mismatch and calls carl9170_restart() but then falls through to memcpy(ar->readbuf, buffer + 4, len - 4). Since len comes from the firmware and can exceed ar->readlen, this copies more data than the readbuf was allocated for. Bound the memcpy to min(len - 4, ar->readlen) so that the response is still completed -- avoiding repeated restarts from queued garbage -- while preventing an overread past the response buffer.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from a84fab3cbfdc427e7d366f1cc844f27b2084c26c before 38e240996a6a78c94ab07d461fd66e361d55c3c4; from a84fab3cbfdc427e7d366f1cc844f27b2084c26c before 2d05c321d27624c413c950278d2dc8e0f44a8950; from a84fab3cbfdc427e7d366f1cc844f27b2084c26c before 525036b20ef01d814a7fcd0567d123992e4479fa; from a84fab3cbfdc427e7d366f1cc844f27b2084c26c before f74e34e66379e487a09009a4f2d42470051672bd; from a84fab3cbfdc427e7d366f1cc844f27b2084c26c before 500c36649f270de05a56591fcc1aaaa36687958e; from a84fab3cbfdc427e7d366f1cc844f27b2084c26c before 9aee949c68dc6dccbc54333537b109c53fe2079f; from a84fab3cbfdc427e7d366f1cc844f27b2084c26c before cb7a38810cf25738176dac32dec7a146b3f959cf; from a84fab3cbfdc427e7d366f1cc844f27b2084c26c before 4cde55b2feff9504d1f993ab80e84e7ccb62791c | CNA record |
References
- https://git.kernel.org/stable/c/38e240996a6a78c94ab07d461fd66e361d55c3c4
- https://git.kernel.org/stable/c/2d05c321d27624c413c950278d2dc8e0f44a8950
- https://git.kernel.org/stable/c/525036b20ef01d814a7fcd0567d123992e4479fa
- https://git.kernel.org/stable/c/f74e34e66379e487a09009a4f2d42470051672bd
- https://git.kernel.org/stable/c/500c36649f270de05a56591fcc1aaaa36687958e
- https://git.kernel.org/stable/c/9aee949c68dc6dccbc54333537b109c53fe2079f
- https://git.kernel.org/stable/c/cb7a38810cf25738176dac32dec7a146b3f959cf
- https://git.kernel.org/stable/c/4cde55b2feff9504d1f993ab80e84e7ccb62791c
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.