CVE-2026-68351None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read When the firmware sends a command response with a length mismatch, carl9170_cmd_callback() logs…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Nov 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
In the Linux kernel, the following vulnerability has been resolved:
wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read
When the firmware sends a command response with a length mismatch, carl9170_cmd_callback() logs the mismatch and calls carl9170_restart() but then falls through to memcpy(ar->readbuf, buffer + 4, len - 4). Since len comes from the firmware and can exceed ar->readlen, this copies more data than the readbuf was allocated for.
Bound the memcpy to min(len - 4, ar->readlen) so that the response is still completed -- avoiding repeated restarts from queued garbage -- while preventing an overread past the response buffer.
Linux >= a84fab3cbfdc427e7d366f1cc844f27b2084c26c < 38e240996a6a78c94ab07d461fd66e361d55c3c4Linux >= a84fab3cbfdc427e7d366f1cc844f27b2084c26c < 2d05c321d27624c413c950278d2dc8e0f44a8950Linux >= a84fab3cbfdc427e7d366f1cc844f27b2084c26c < 525036b20ef01d814a7fcd0567d123992e4479faLinux >= a84fab3cbfdc427e7d366f1cc844f27b2084c26c < f74e34e66379e487a09009a4f2d42470051672bdLinux >= a84fab3cbfdc427e7d366f1cc844f27b2084c26c < 500c36649f270de05a56591fcc1aaaa36687958eLinux >= a84fab3cbfdc427e7d366f1cc844f27b2084c26c < 9aee949c68dc6dccbc54333537b109c53fe2079fLinux >= a84fab3cbfdc427e7d366f1cc844f27b2084c26c < cb7a38810cf25738176dac32dec7a146b3f959cfLinux >= a84fab3cbfdc427e7d366f1cc844f27b2084c26c < 4cde55b2feff9504d1f993ab80e84e7ccb62791cLinux 2.6.37Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99284Nonenet: skbuff: propagate shared-frag marker in skb_zerocopy()
CVE-2026-99283Nonenetfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets
CVE-2026-99272Nonesmb: client: validate the data area in SMB2_read()
CVE-2026-99271NoneALSA: line6: Clear prev_fbuf on capture buffer release
CVE-2026-99273Noneksmbd: reserve space for the UTF-16 terminator in stream info
CVE-2026-99275Nonesmb: client: reject short SESSION_SETUP responses