CVE-2026-68351

wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read

State: Published
Severity: Not scored
Published: Aug 10, 2026
Updated: Aug 19, 2026
Reserved: Jul 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read

When the firmware sends a command response with a length mismatch, carl9170_cmd_callback() logs the mismatch and calls carl9170_restart() but then falls through to memcpy(ar->readbuf, buffer + 4, len - 4). Since len comes from the firmware and can exceed ar->readlen, this copies more data than the readbuf was allocated for.

Bound the memcpy to min(len - 4, ar->readlen) so that the response is still completed -- avoiding repeated restarts from queued garbage -- while preventing an overread past the response buffer.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before 38e240996a6a78c94ab07d461fd66e361d55c3c4Affected a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before 2d05c321d27624c413c950278d2dc8e0f44a8950Affected a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before 525036b20ef01d814a7fcd0567d123992e4479faAffected a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before f74e34e66379e487a09009a4f2d42470051672bdAffected a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before 500c36649f270de05a56591fcc1aaaa36687958eAffected a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before 9aee949c68dc6dccbc54333537b109c53fe2079fAffected a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before cb7a38810cf25738176dac32dec7a146b3f959cfAffected a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before 4cde55b2feff9504d1f993ab80e84e7ccb62791cAffected
LinuxLinux	2.6.37Affected before 2.6.37Not affected 5.10.265 through 5.10.Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.148 through 6.6.Not affected 6.12.101 through 6.12.Not affected 6.18.42 through 6.18.Not affected 7.1.6 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before 38e240996a6a78c94ab07d461fd66e361d55c3c4Affected
a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before 2d05c321d27624c413c950278d2dc8e0f44a8950Affected
a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before 525036b20ef01d814a7fcd0567d123992e4479faAffected
a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before f74e34e66379e487a09009a4f2d42470051672bdAffected
a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before 500c36649f270de05a56591fcc1aaaa36687958eAffected
a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before 9aee949c68dc6dccbc54333537b109c53fe2079fAffected
a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before cb7a38810cf25738176dac32dec7a146b3f959cfAffected
a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before 4cde55b2feff9504d1f993ab80e84e7ccb62791cAffected

LinuxLinux

2.6.37Affected
before 2.6.37Not affected
5.10.265 through 5.10.*Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.148 through 6.6.*Not affected
6.12.101 through 6.12.*Not affected
6.18.42 through 6.18.*Not affected
7.1.6 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.