CVE-2026-68351

A flaw was found in the carl9170 Wi-Fi driver in the Linux kernel. When the firmware sends a command response with a length mismatch, the carl9170_cmd_callback() function performs an out-of-bounds read. This occurs because the memcpy operation copies more data than the allocated buffer, potentially leading to information disclosure or system instability.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation requires physical or hypervisor-level access to connect a malicious USB device or interact with compromised device firmware. The carl9170 Wi-Fi driver is primarily utilized for Atheros AR9170 wireless USB adapters, which are uncommon in enterprise server deployments. Consequently, the flaw presents limited real-world exposure and is constrained to local denial of service or potential privilege escalation on systems where this specific hardware is connected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.