SB20260812179 - Heap-based buffer overflow in Linux kernel ath carl9170 driver

Description

This security bulletin contains information about 1 vulnerability.

1) Heap-based buffer overflow (CVE-ID: CVE-2026-68349)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in carl9170_rx_stream() when processing USB transfer data in the rx stream failover path. A local attacker can provide specially crafted transfer data to cause a denial of service.

The issue is triggered when two transfers are near the maximum size and their combined copied length exceeds the 65535-byte failover SKB, resulting in skb_over_panic.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/21f59906ea75618fdd46a7e32754d54fbee083ea
• https://git.kernel.org/stable/c/4503829843353dbb18b879c35be1cdfc9af677b7
• https://git.kernel.org/stable/c/5acfa18de66b6089b81c1c0bf1a3ae3c940ec39e
• https://git.kernel.org/stable/c/a1a21995c2e1cc2ca6b2226cfe4f5f018370182a
• https://git.kernel.org/stable/c/b9dfee5e63ee9b5c47be9e344ebc5bd3f43fca78