CVE-2026-68349

wifi: carl9170: fix buffer overflow in rx_stream failover path

State: Published
Severity: Not scored
Published: Aug 10, 2026
Updated: Aug 19, 2026
Reserved: Jul 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: carl9170: fix buffer overflow in rx_stream failover path

The failover continuation in carl9170_rx_stream() copies the full tlen from the second USB transfer instead of capping at rx_failover_missing bytes. When both transfers are near maximum size, the total exceeds the 65535-byte failover SKB, triggering skb_over_panic.

Limit the copy size to the missing byte count.

[Fix checkpatch CHECK:PARENTHESIS_ALIGNMENT]

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before 5fb00a09e9b0375e1ad9d4fefc4a62a67e7ea658Affected a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before 48c81fb523ecdc6a4b8654944ff32e499f21e6d0Affected a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before a1ce01764a812c22a47d30aea78e347aebd3eea1Affected a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before 5acfa18de66b6089b81c1c0bf1a3ae3c940ec39eAffected a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before b9dfee5e63ee9b5c47be9e344ebc5bd3f43fca78Affected a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before 4503829843353dbb18b879c35be1cdfc9af677b7Affected a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before 21f59906ea75618fdd46a7e32754d54fbee083eaAffected a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before a1a21995c2e1cc2ca6b2226cfe4f5f018370182aAffected
LinuxLinux	2.6.37Affected before 2.6.37Not affected 5.10.265 through 5.10.Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.148 through 6.6.Not affected 6.12.101 through 6.12.Not affected 6.18.42 through 6.18.Not affected 7.1.6 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before 5fb00a09e9b0375e1ad9d4fefc4a62a67e7ea658Affected
a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before 48c81fb523ecdc6a4b8654944ff32e499f21e6d0Affected
a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before a1ce01764a812c22a47d30aea78e347aebd3eea1Affected
a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before 5acfa18de66b6089b81c1c0bf1a3ae3c940ec39eAffected
a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before b9dfee5e63ee9b5c47be9e344ebc5bd3f43fca78Affected
a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before 4503829843353dbb18b879c35be1cdfc9af677b7Affected
a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before 21f59906ea75618fdd46a7e32754d54fbee083eaAffected
a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before a1a21995c2e1cc2ca6b2226cfe4f5f018370182aAffected

LinuxLinux

2.6.37Affected
before 2.6.37Not affected
5.10.265 through 5.10.*Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.148 through 6.6.*Not affected
6.12.101 through 6.12.*Not affected
6.18.42 through 6.18.*Not affected
7.1.6 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.