CVE-2026-68349: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-68349 Overview

CVE-2026-68349 is a buffer overflow vulnerability in the Linux kernel's carl9170 Wi-Fi driver, which supports Atheros AR9170-based USB wireless adapters. The flaw resides in the carl9170_rx_stream() function, where the failover continuation path copies the full tlen value from the second USB transfer rather than capping the copy at rx_failover_missing bytes. When both USB transfers approach maximum size, the combined length exceeds the 65535-byte failover socket buffer (SKB), triggering skb_over_panic and causing a kernel panic.

Critical Impact
A malicious or malformed USB Wi-Fi transfer sequence can overflow the failover SKB in the carl9170 driver, resulting in skb_over_panic and a kernel denial-of-service condition on affected Linux systems.

Affected Products

Linux kernel versions containing the carl9170 Wi-Fi USB driver prior to the referenced stable commits
Systems using Atheros AR9170-based USB wireless adapters supported by carl9170
Multiple stable Linux kernel branches receiving backported fixes

Discovery Timeline

2026-08-10 - CVE-2026-68349 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68349

Vulnerability Analysis

The carl9170 driver reassembles RX (receive) stream data delivered across multiple USB bulk transfers. When a stream header indicates that a frame extends beyond the current transfer, the driver allocates a failover SKB sized to hold up to 65535 bytes and records rx_failover_missing — the number of bytes still needed to complete the frame.

On the next USB transfer, the failover path should copy at most rx_failover_missing bytes into the SKB. Instead, the code copied the entire tlen (total length) of the incoming transfer. When two consecutive transfers were near the maximum USB bulk transfer size, the aggregate write exceeded the SKB's tail capacity and triggered skb_over_panic, halting the kernel.

Root Cause

The root cause is an improper bounds check on the copy length during RX stream reassembly. The driver used the untrusted transfer length instead of the previously computed missing-byte counter, allowing the copy to exceed the destination buffer. This is a classic buffer overflow [CWE-120] in kernel networking code, restricted to the failover continuation branch of carl9170_rx_stream().

Attack Vector

Exploitation requires the target system to process crafted RX stream data delivered through the carl9170 USB Wi-Fi device path. A physically attached malicious or malfunctioning USB device, or a compromised firmware image on a legitimate adapter, can produce transfer sequences that trigger the overflow. The observable outcome documented in the fix is skb_over_panic, a kernel panic and denial of service. Memory corruption preceding the panic is possible because the copy writes past the SKB tail before the panic check fires.

No verified exploitation code is publicly available for CVE-2026-68349. The upstream fix limits the copy to rx_failover_missing bytes. Refer to the Linux Kernel Commit 21f5990 and the Linux Kernel Commit b9dfee5 for the patch details.

Detection Methods for CVE-2026-68349

Indicators of Compromise

Kernel log entries containing skb_over_panic originating from the carl9170 module
Unexpected kernel panics or system crashes on hosts using Atheros AR9170 USB Wi-Fi adapters
Repeated USB reconnection events for carl9170 devices immediately preceding a crash

Detection Strategies

Audit running kernels for the presence of the unpatched carl9170 driver and compare against the fixed stable commits
Monitor dmesg and journald output for skb_over_panic, BUG:, and carl9170 co-occurring messages
Correlate USB device attach events with kernel oops or panic reports across the fleet

Monitoring Recommendations

Forward kernel logs to a centralized log platform and alert on skb_over_panic and carl9170 string matches
Track kernel module versions and package inventory to identify hosts still running vulnerable builds
Alert on unexpected USB Wi-Fi adapter insertion on servers and fixed-function endpoints where such devices are not authorized

How to Mitigate CVE-2026-68349

Immediate Actions Required

Apply the vendor-supplied kernel update from your Linux distribution that incorporates the upstream carl9170 fix
Reboot affected hosts after upgrading to load the patched kernel
Restrict physical and USB access on systems that cannot be immediately updated

Patch Information

The fix limits the copy size in the failover continuation of carl9170_rx_stream() to rx_failover_missing bytes, preventing the write from exceeding the 65535-byte failover SKB. The change has been merged into mainline and backported to multiple stable branches. See the upstream commits: Linux Kernel Commit 21f5990, Linux Kernel Commit 4503829, Linux Kernel Commit 5acfa18, Linux Kernel Commit a1a2199, and Linux Kernel Commit b9dfee5.

Workarounds

Blacklist the carl9170 kernel module on systems that do not require Atheros AR9170 USB Wi-Fi support
Physically remove or disable affected USB Wi-Fi adapters until the patched kernel is deployed
Enforce USB device authorization policies to prevent untrusted USB Wi-Fi devices from binding to carl9170

bash

# Blacklist the carl9170 module until the kernel is patched
echo "blacklist carl9170" | sudo tee /etc/modprobe.d/blacklist-carl9170.conf
sudo rmmod carl9170 2>/dev/null || true
sudo update-initramfs -u