CVE-2026-68350: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-68350 Overview

CVE-2026-68350 is an out-of-bounds read vulnerability in the Linux kernel's carl9170 wireless driver. The flaw resides in the carl9170_tx_process_status() function, which handles transmission status reports from Atheros AR9170-based USB Wi-Fi adapters. An off-by-two error in the bounds check permits the loop to iterate two positions beyond the valid _tx_status array when firmware-controlled hdr.ext exceeds hdr.len/2. This allows a malicious or malfunctioning device to trigger reads past the intended buffer boundary in kernel memory.

Critical Impact
A firmware-controlled field can drive the driver into reading two extra entries beyond the valid TX status array, resulting in kernel memory disclosure or unexpected driver state.

Affected Products

Linux kernel builds containing the carl9170 USB wireless driver prior to the referenced stable patches
Systems using Atheros AR9170-based USB Wi-Fi adapters
Distributions shipping the vulnerable kernel that have not yet backported the fix

Discovery Timeline

2026-08-10 - CVE-2026-68350 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68350

Vulnerability Analysis

The carl9170 driver processes TX status reports delivered by the device firmware inside carl9170_tx_process_status(). The function iterates over an array of _tx_status entries described by cmd->hdr.len, using the loop condition i > ((cmd->hdr.len / 2) + 1) as its termination check. Because the comparison adds one and uses strict > rather than >=, the loop can execute two additional iterations beyond the last valid entry when the firmware sets hdr.ext such that it exceeds hdr.len/2. Each extra iteration reads from memory adjacent to the intended array, producing an out-of-bounds read [CWE-125].

Root Cause

The root cause is an incorrect loop bound. The original expression i > ((cmd->hdr.len / 2) + 1) treats the boundary condition inclusively and adds an extra +1, overshooting the valid range. The correction replaces the check with i >= (cmd->hdr.len / 2), which aligns the loop bound with the actual entry count. The fix appears across stable branches in commits 423c836f9348, 7ed0dce8613c, a3f42f1049ad, e8a862a3da45, and fab6ff91d5b8.

Attack Vector

Exploitation requires that the driver process crafted or malformed TX status headers from the connected USB Wi-Fi device. An attacker capable of supplying malicious firmware or a rogue USB device that emulates an AR9170 adapter can set hdr.ext and hdr.len values that trigger the off-by-two condition. The resulting out-of-bounds read may leak adjacent kernel memory contents to driver logic or induce inconsistent state during TX status accounting. Physical access or the ability to control a USB peripheral is generally required.

Detection Methods for CVE-2026-68350

Indicators of Compromise

Kernel logs referencing carl9170 combined with unexpected TX status accounting anomalies or KASAN reports
Presence of AR9170 USB devices with atypical firmware versions or firmware sourced from untrusted origins
Unexpected USB device enumeration events on systems that do not normally use carl9170 hardware

Detection Strategies

Enable KASAN on test kernels to catch the out-of-bounds read at runtime in carl9170_tx_process_status()
Audit installed kernel versions against the stable commits listed in the Kernel Git Commit 423c83 reference set
Monitor USB device attach events for AR9170-class Wi-Fi adapters and correlate with kernel warnings from the carl9170 subsystem

Monitoring Recommendations

Forward dmesg and journald kernel logs to a central log store to surface carl9170 warnings and USB reset events
Track kernel package versions across the fleet and flag hosts still running vulnerable builds
Baseline expected USB peripherals on endpoints and alert on unauthorized wireless adapters attaching to workstations or servers

How to Mitigate CVE-2026-68350

Immediate Actions Required

Apply the vendor kernel update containing the corrected bounds check for carl9170_tx_process_status()
Unload the carl9170 module on systems that do not require AR9170 USB Wi-Fi support using modprobe -r carl9170
Restrict USB device attachment on sensitive systems through USB port control or endpoint policy

Patch Information

The fix replaces the off-by-two comparison with i >= (cmd->hdr.len / 2) and is available in the following stable tree commits: Kernel Git Commit 423c83, Kernel Git Commit 7ed0dc, Kernel Git Commit a3f42f, Kernel Git Commit e8a862, and Kernel Git Commit fab6ff. Distribution maintainers should backport the change to any supported kernel that still ships the vulnerable loop.

Workarounds

Blacklist the carl9170 module in /etc/modprobe.d/ on hosts that do not use AR9170 hardware
Physically disconnect AR9170 USB adapters from production systems until patched kernels are deployed
Enforce USB device authorization policies to block untrusted Wi-Fi adapters from binding to the driver

bash

# Blacklist the vulnerable driver until the kernel is patched
echo "blacklist carl9170" | sudo tee /etc/modprobe.d/blacklist-carl9170.conf
sudo modprobe -r carl9170
sudo update-initramfs -u