CVE-2026-68349 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: carl9170: fix buffer overflow in rx_stream failover path
The failover continuation in carl9170_rx_stream() copies the full tlen from the second USB transfer instead of capping at rx_failover_missing bytes. When both transfers are near maximum size, the total exceeds the 65535-byte failover SKB, triggering skb_over_panic.
Limit the copy size to the missing byte count.
[Fix checkpatch CHECK:PARENTHESIS_ALIGNMENT]
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability resides in the carl9170 wireless driver within the Linux kernel, specifically addressing a buffer overflow condition that occurs during the receive stream failover process. This flaw affects the handling of USB transfers where the driver manages data reception from wireless network adapters. The technical implementation involves the carl9170_rx_stream() function which processes incoming data through multiple USB transfer operations, creating a scenario where improper memory management can lead to critical system instability.
The core technical flaw manifests when the failover continuation logic copies the complete transfer length (tlen) from a secondary USB transfer without proper bounds checking against the expected missing byte count. This design oversight becomes problematic when both USB transfers approach their maximum operational sizes simultaneously, causing the cumulative data to exceed the allocated 65535-byte buffer space designated for the failover SKB (socket buffer). The consequence is an skb_over_panic condition that represents a critical kernel memory corruption event, potentially leading to system crashes or privilege escalation opportunities.
The operational impact of this vulnerability extends beyond simple system instability, as it can be exploited by malicious actors to cause denial of service attacks against wireless network functionality. When triggered, the buffer overflow can result in kernel panics, system reboots, and potentially allow attackers to execute arbitrary code within kernel space. The vulnerability particularly affects systems running Linux kernels with the carl9170 wireless driver implementation, making it relevant to a wide range of embedded devices, routers, and network equipment that utilize this specific wireless chipset.
The fix implements a crucial boundary check that limits the copy operation to exactly the missing byte count rather than allowing the full transfer length to be copied. This approach aligns with established security principles for buffer management and memory safety practices. The solution directly addresses the underlying CWE-121 stack-based buffer overflow condition by ensuring proper bounds checking before memory operations. Additionally, this mitigation strategy provides protection against potential exploitation through the ATT&CK technique T1068, which involves local privilege escalation through kernel vulnerabilities.
The implementation of this fix represents a standard defensive programming approach that prevents overflows by enforcing strict data size limitations and maintains system integrity through proper resource management. The correction ensures that memory operations remain within allocated boundaries while preserving the functionality of the wireless driver's failover mechanism. This vulnerability resolution demonstrates the importance of careful buffer management in kernel space code, particularly when dealing with network protocols and USB transfer operations where data sizes can vary significantly based on network conditions and hardware capabilities.
The fix also addresses a secondary checkpatch warning related to PARENTHESIS_ALIGNMENT, indicating proper code formatting practices were maintained alongside the functional security improvements. This dual approach to vulnerability remediation ensures both operational correctness and adherence to kernel coding standards that help prevent similar issues in other driver components. The resolution maintains backward compatibility while providing robust protection against buffer overflow exploitation attempts.