CVE-2026-68349 wifi: carl9170: fix buffer overflow in rx_stream failover path
A buffer overflow in the carl9170 WiFi driver can cause a kernel panic via crafted USB transfers, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-68349?
CVE-2026-68349 is a memory corruption vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: carl9170: fix buffer overflow in rx_stream failover path
The failover continuation in carl9170_rx_stream() copies the full tlen from the second USB transfer instead of capping at rx_failover_missing bytes. When both transfers are near maximum size, the total exceeds the 65535-byte failover SKB, triggering skb_over_panic.
Limit the copy size to the missing byte count.
[Fix checkpatch CHECK:PARENTHESIS_ALIGNMENT]
Which versions are affected by CVE-2026-68349?
How do I fix CVE-2026-68349?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-68349 being exploited?
There is no known exploitation of CVE-2026-68349 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-68349, DEBIAN-CVE-2026-68349, GHSA-fpjh-9gv6-cr6g, UBUNTU-CVE-2026-68349.