{"id":"CVE-2026-68351","summary":"wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: carl9170: bound memcpy length in cmd callback to prevent OOB read\n\nWhen the firmware sends a command response with a length mismatch,\ncarl9170_cmd_callback() logs the mismatch and calls carl9170_restart()\nbut then falls through to memcpy(ar-\u003ereadbuf, buffer + 4, len - 4).\nSince len comes from the firmware and can exceed ar-\u003ereadlen, this\ncopies more data than the readbuf was allocated for.\n\nBound the memcpy to min(len - 4, ar-\u003ereadlen) so that the response\nis still completed -- avoiding repeated restarts from queued garbage --\nwhile preventing an overread past the response buffer.","modified":"2026-08-21T03:30:45.147979753Z","published":"2026-08-10T12:03:28.312Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68351.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/2d05c321d27624c413c950278d2dc8e0f44a8950"},{"type":"WEB","url":"https://git.kernel.org/stable/c/38e240996a6a78c94ab07d461fd66e361d55c3c4"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4cde55b2feff9504d1f993ab80e84e7ccb62791c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/500c36649f270de05a56591fcc1aaaa36687958e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/525036b20ef01d814a7fcd0567d123992e4479fa"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9aee949c68dc6dccbc54333537b109c53fe2079f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/cb7a38810cf25738176dac32dec7a146b3f959cf"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f74e34e66379e487a09009a4f2d42470051672bd"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68351.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68351"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"a84fab3cbfdc427e7d366f1cc844f27b2084c26c"},{"fixed":"38e240996a6a78c94ab07d461fd66e361d55c3c4"},{"fixed":"2d05c321d27624c413c950278d2dc8e0f44a8950"},{"fixed":"525036b20ef01d814a7fcd0567d123992e4479fa"},{"fixed":"f74e34e66379e487a09009a4f2d42470051672bd"},{"fixed":"500c36649f270de05a56591fcc1aaaa36687958e"},{"fixed":"9aee949c68dc6dccbc54333537b109c53fe2079f"},{"fixed":"cb7a38810cf25738176dac32dec7a146b3f959cf"},{"fixed":"4cde55b2feff9504d1f993ab80e84e7ccb62791c"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-68351.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.37"},{"fixed":"5.10.265"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.216"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.183"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.148"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.101"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.42"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.6"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-68351.json"}}],"schema_version":"1.9.0"}