GHSA-GRVP-5P4H-RCMP

Vulnerability from github – Published: 2026-08-10 15:33 – Updated: 2026-08-19 18:32
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read

When the firmware sends a command response with a length mismatch, carl9170_cmd_callback() logs the mismatch and calls carl9170_restart() but then falls through to memcpy(ar->readbuf, buffer + 4, len - 4). Since len comes from the firmware and can exceed ar->readlen, this copies more data than the readbuf was allocated for.

Bound the memcpy to min(len - 4, ar->readlen) so that the response is still completed -- avoiding repeated restarts from queued garbage -- while preventing an overread past the response buffer.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-68351"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-10T13:20:27Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: carl9170: bound memcpy length in cmd callback to prevent OOB read\n\nWhen the firmware sends a command response with a length mismatch,\ncarl9170_cmd_callback() logs the mismatch and calls carl9170_restart()\nbut then falls through to memcpy(ar-\u003ereadbuf, buffer + 4, len - 4).\nSince len comes from the firmware and can exceed ar-\u003ereadlen, this\ncopies more data than the readbuf was allocated for.\n\nBound the memcpy to min(len - 4, ar-\u003ereadlen) so that the response\nis still completed -- avoiding repeated restarts from queued garbage --\nwhile preventing an overread past the response buffer.",
  "id": "GHSA-grvp-5p4h-rcmp",
  "modified": "2026-08-19T18:32:16Z",
  "published": "2026-08-10T15:33:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68351"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2d05c321d27624c413c950278d2dc8e0f44a8950"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/38e240996a6a78c94ab07d461fd66e361d55c3c4"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4cde55b2feff9504d1f993ab80e84e7ccb62791c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/500c36649f270de05a56591fcc1aaaa36687958e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/525036b20ef01d814a7fcd0567d123992e4479fa"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9aee949c68dc6dccbc54333537b109c53fe2079f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cb7a38810cf25738176dac32dec7a146b3f959cf"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f74e34e66379e487a09009a4f2d42470051672bd"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.