CVE-2026-68351

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read<br /> <br /> When the firmware sends a command response with a length mismatch,<br /> carl9170_cmd_callback() logs the mismatch and calls carl9170_restart()<br /> but then falls through to memcpy(ar-&gt;readbuf, buffer + 4, len - 4).<br /> Since len comes from the firmware and can exceed ar-&gt;readlen, this<br /> copies more data than the readbuf was allocated for.<br /> <br /> Bound the memcpy to min(len - 4, ar-&gt;readlen) so that the response<br /> is still completed -- avoiding repeated restarts from queued garbage --<br /> while preventing an overread past the response buffer.