CVE-2026-68351: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-68351 Overview

CVE-2026-68351 is an out-of-bounds read vulnerability in the Linux kernel's carl9170 Wi-Fi driver. The flaw resides in the carl9170_cmd_callback() function, which processes command responses sent by the device firmware. When the firmware returns a response with a length field that does not match the expected value, the driver logs the mismatch and calls carl9170_restart(), but execution continues into a memcpy() that uses the firmware-supplied length. This lets the driver copy more bytes into ar->readbuf than the buffer was allocated to hold, resulting in an out-of-bounds read past the response buffer.

Critical Impact
A malicious or malfunctioning carl9170 USB Wi-Fi device can trigger an out-of-bounds read in kernel memory, leading to information disclosure or kernel instability.

Affected Products

Linux kernel (upstream stable trees containing the carl9170 wireless driver)
Systems using Atheros AR9170-based USB Wi-Fi adapters
Distributions shipping unpatched carl9170 driver builds

Discovery Timeline

2026-08-10 - CVE-2026-68351 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68351

Vulnerability Analysis

The carl9170 driver handles command responses from firmware over USB. Inside carl9170_cmd_callback(), the driver compares the firmware-declared response length against the expected ar->readlen. When the values disagree, the driver emits a diagnostic and calls carl9170_restart() to reset the device state.

Execution does not return after that restart call. The function falls through to memcpy(ar->readbuf, buffer + 4, len - 4), where len is the untrusted length taken directly from the firmware buffer. Because len may exceed ar->readlen, the source pointer is read past the boundary of the allocated response buffer, producing a kernel out-of-bounds read [CWE-125].

The upstream fix bounds the copy length to min(len - 4, ar->readlen). This preserves response completion behavior — preventing repeated restart loops driven by queued malformed responses — while ensuring the memcpy() never reads beyond the allocated buffer.

Root Cause

The root cause is missing bounds enforcement on an attacker-influenced length value after a validation failure. The mismatch handler logs and triggers a restart but does not return or clamp len before the subsequent memcpy(), so untrusted firmware data continues to drive the copy size.

Attack Vector

Exploitation requires a carl9170-compatible USB Wi-Fi device that can send crafted command responses to the host kernel. This includes a physically attached malicious USB device, a compromised device with modified firmware, or a device targeted through firmware-level tampering. The out-of-bounds read occurs in kernel context and can leak adjacent kernel memory or cause driver instability.

See the upstream patches for the exact code change across affected stable branches:

Detection Methods for CVE-2026-68351

Indicators of Compromise

Kernel log entries from the carl9170 driver reporting command response length mismatches.
Repeated carl9170_restart() invocations followed by continued driver activity on the same device.
Unexpected USB attach or reattach events for AR9170-based Wi-Fi adapters on sensitive hosts.

Detection Strategies

Audit installed kernel versions across Linux endpoints and compare against the fixed commits listed in the stable trees.
Enable KASAN on test kernels to surface out-of-bounds reads originating in carl9170_cmd_callback().
Correlate dmesg entries containing carl9170 warnings with USB device connection events from udev or systemd journal.

Monitoring Recommendations

Ship kernel logs and USB device events into a centralized data lake for review.
Alert on new or unexpected USB Wi-Fi devices attaching to servers, workstations, or laboratory hosts.
Track kernel package versions as part of endpoint inventory to identify hosts still exposed to CVE-2026-68351.

How to Mitigate CVE-2026-68351

Immediate Actions Required

Apply the vendor kernel update that includes the bounded memcpy() fix in carl9170_cmd_callback().
Reboot affected systems after installing the patched kernel so the fixed driver is loaded.
Restrict physical and USB access on hosts where the carl9170 driver is in use.

Patch Information

The upstream fix bounds the memcpy length to min(len - 4, ar->readlen) in carl9170_cmd_callback(). The change is available across multiple stable kernel branches through the commits referenced above. Consume the fix through your Linux distribution's kernel update channel to receive the backport that matches your kernel series.

Workarounds

Unload the driver with modprobe -r carl9170 on systems that do not require AR9170 Wi-Fi support.
Blacklist the module by adding blacklist carl9170 to a file under /etc/modprobe.d/ to prevent auto-load.
Use USB port control (for example, USBGuard) to block unauthorized Wi-Fi adapters from attaching.

bash

# Prevent the vulnerable driver from loading until the kernel is patched
echo "blacklist carl9170" | sudo tee /etc/modprobe.d/blacklist-carl9170.conf
sudo modprobe -r carl9170 2>/dev/null || true
sudo update-initramfs -u