A buffer overflow exists in the carl9170 Wi‑Fi driver of the Linux kernel, specifically within the rx_stream failover path. The driver incorrectly copies the entire transfer length from the second USB transfer rather than capping it at the number of missing bytes. When both transfers approach the maximum size, the combined data exceeds the 65,535‑byte capacity of the failover socket buffer, triggering an skb_over_panic. This kernel panic results in a kernel‑space memory corruption that can lead to denial‑of‑service, depending on the attacker’s objectives.

The vulnerability affects any Linux kernel system running the carl9170 driver prior to the patch that limits the copy size to the missing byte count. No specific vendor or product version list is provided, so any system deploying the unpatched driver is impacted.

The CVSS score is 5.9, and the EPSS score is < 1%, indicating a very low probability of exploitation. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. The likely attack vector is a maliciously crafted Wi‑Fi packet or USB traffic delivered to the device by a remote or local attacker who can control the data transmitted to the driver. If exploited, the kernel panic could be leveraged for denial of service, depending on the attacker’s objectives.