CVE-2026-68351 wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read
A missing bounds check in the carl9170 Wi-Fi driver allows out-of-bounds reads, potentially leaking memory or causing crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-68351?
CVE-2026-68351 is a memory corruption vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read
When the firmware sends a command response with a length mismatch, carl9170_cmd_callback() logs the mismatch and calls carl9170_restart() but then falls through to memcpy(ar->readbuf, buffer + 4, len - 4). Since len comes from the firmware and can exceed ar->readlen, this copies more data than the readbuf was allocated for.
Bound the memcpy to min(len - 4, ar->readlen) so that the response is still completed -- avoiding repeated restarts from queued garbage -- while preventing an overread past the response buffer.
Which versions are affected by CVE-2026-68351?
How do I fix CVE-2026-68351?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-68351 being exploited?
There is no known exploitation of CVE-2026-68351 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-68351, DEBIAN-CVE-2026-68351, GHSA-grvp-5p4h-rcmp, UBUNTU-CVE-2026-68351.