CVE-2026-68351

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds read exists in the carl9170 cmd callback() function. When the firmware sends a command response with a length mismatch, the system logs the error and initiates a restart but continues to execute a memcpy() operation. Because the len variable is provided by the firmware and can exceed the allocated size of ar->readbuf, the operation may copy more data than the buffer can hold, leading to an overread past the response buffer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.