CVE-2026-68350 wifi: carl9170: fix OOB read from off-by-two in TX status handler
An off-by-two error in the carl9170 WiFi driver allows out-of-bounds reads, potentially leaking memory or causing crashes for local attackers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-68350?
CVE-2026-68350 is a memory corruption vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: carl9170: fix OOB read from off-by-two in TX status handler
The bounds check in carl9170_tx_process_status() uses `i > ((cmd->hdr.len / 2) + 1)` which is off by two, allowing 2 extra iterations past valid _tx_status entries when the firmware- controlled hdr.ext exceeds hdr.len/2. Fix by using the correct comparison `i >= (cmd->hdr.len / 2)`.
Which versions are affected by CVE-2026-68350?
How do I fix CVE-2026-68350?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-68350 being exploited?
There is no known exploitation of CVE-2026-68350 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-68350, DEBIAN-CVE-2026-68350, GHSA-wg7x-4p3f-2w22, UBUNTU-CVE-2026-68350.