CVE-2026-68350

In the Linux kernel wifi carl9170 driver, a vulnerability exists in carl9170_tx_process_status() due to an off-by-two bounds check. The condition i > ((cmd->hdr.len / 2) + 1) permits two extra iterations past valid _tx_status entries when hdr.ext exceeds hdr.len/2, enabling an out-of-bounds...