---
id: CVE-2026-68349
title: 'wifi: carl9170: fix buffer overflow in rx_stream failover path'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: carl9170: fix buffer overflow in rx_stream failover path

  The failover continuation in carl9170_rx_stream() copies the full tlen
  from the second USB transfer inst…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a84fab3cbfdc427e7d366f1cc844f27b2084c26c <
    5fb00a09e9b0375e1ad9d4fefc4a62a67e7ea658
  - >-
    Linux >= a84fab3cbfdc427e7d366f1cc844f27b2084c26c <
    48c81fb523ecdc6a4b8654944ff32e499f21e6d0
  - >-
    Linux >= a84fab3cbfdc427e7d366f1cc844f27b2084c26c <
    a1ce01764a812c22a47d30aea78e347aebd3eea1
  - >-
    Linux >= a84fab3cbfdc427e7d366f1cc844f27b2084c26c <
    5acfa18de66b6089b81c1c0bf1a3ae3c940ec39e
  - >-
    Linux >= a84fab3cbfdc427e7d366f1cc844f27b2084c26c <
    b9dfee5e63ee9b5c47be9e344ebc5bd3f43fca78
  - >-
    Linux >= a84fab3cbfdc427e7d366f1cc844f27b2084c26c <
    4503829843353dbb18b879c35be1cdfc9af677b7
  - >-
    Linux >= a84fab3cbfdc427e7d366f1cc844f27b2084c26c <
    21f59906ea75618fdd46a7e32754d54fbee083ea
  - >-
    Linux >= a84fab3cbfdc427e7d366f1cc844f27b2084c26c <
    a1a21995c2e1cc2ca6b2226cfe4f5f018370182a
  - Linux 2.6.37
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:47:38.974453Z'
published: '2026-08-10'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:55:13.745Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68349'
references:
  - url: 'https://git.kernel.org/stable/c/5fb00a09e9b0375e1ad9d4fefc4a62a67e7ea658'
  - url: 'https://git.kernel.org/stable/c/48c81fb523ecdc6a4b8654944ff32e499f21e6d0'
  - url: 'https://git.kernel.org/stable/c/a1ce01764a812c22a47d30aea78e347aebd3eea1'
  - url: 'https://git.kernel.org/stable/c/5acfa18de66b6089b81c1c0bf1a3ae3c940ec39e'
  - url: 'https://git.kernel.org/stable/c/b9dfee5e63ee9b5c47be9e344ebc5bd3f43fca78'
  - url: 'https://git.kernel.org/stable/c/4503829843353dbb18b879c35be1cdfc9af677b7'
  - url: 'https://git.kernel.org/stable/c/21f59906ea75618fdd46a7e32754d54fbee083ea'
  - url: 'https://git.kernel.org/stable/c/a1a21995c2e1cc2ca6b2226cfe4f5f018370182a'
tags:
  - cve.org
epss: 0.00204
epssPercentile: 0.104
ingestedAt: '2026-11-06T18:00:12.610Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: carl9170: fix buffer overflow in rx_stream failover path

The failover continuation in carl9170_rx_stream() copies the full tlen
from the second USB transfer instead of capping at rx_failover_missing
bytes. When both transfers are near maximum size, the total exceeds the
65535-byte failover SKB, triggering skb_over_panic.

Limit the copy size to the missing byte count.

[Fix checkpatch CHECK:PARENTHESIS_ALIGNMENT]

## Affected

- `Linux >= a84fab3cbfdc427e7d366f1cc844f27b2084c26c < 5fb00a09e9b0375e1ad9d4fefc4a62a67e7ea658`
- `Linux >= a84fab3cbfdc427e7d366f1cc844f27b2084c26c < 48c81fb523ecdc6a4b8654944ff32e499f21e6d0`
- `Linux >= a84fab3cbfdc427e7d366f1cc844f27b2084c26c < a1ce01764a812c22a47d30aea78e347aebd3eea1`
- `Linux >= a84fab3cbfdc427e7d366f1cc844f27b2084c26c < 5acfa18de66b6089b81c1c0bf1a3ae3c940ec39e`
- `Linux >= a84fab3cbfdc427e7d366f1cc844f27b2084c26c < b9dfee5e63ee9b5c47be9e344ebc5bd3f43fca78`
- `Linux >= a84fab3cbfdc427e7d366f1cc844f27b2084c26c < 4503829843353dbb18b879c35be1cdfc9af677b7`
- `Linux >= a84fab3cbfdc427e7d366f1cc844f27b2084c26c < 21f59906ea75618fdd46a7e32754d54fbee083ea`
- `Linux >= a84fab3cbfdc427e7d366f1cc844f27b2084c26c < a1a21995c2e1cc2ca6b2226cfe4f5f018370182a`
- `Linux 2.6.37`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.