CVE-2026-68351

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read

When the firmware sends a command response with a length mismatch,

carl9170_cmd_callback() logs the mismatch and calls carl9170_restart()

but then falls through to memcpy(ar->readbuf, buffer + 4, len - 4).

Since len comes from the firmware and can exceed ar->readlen, this

copies more data than the readbuf was allocated for.

Bound the memcpy to min(len - 4, ar->readlen) so that the response

is still completed -- avoiding repeated restarts from queued garbage --

while preventing an overread past the response buffer.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References