CVE-2026-68373
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
In the Linux kernel, the at76c50x-usb driver has a length underflow vulnerability in at76_guess_freq(). If a frame is shorter than the expected offset, the calculated IE length wraps, leading to an out-of-bounds read during scanning.
Risk Assessment
An attacker can supply truncated beacon or probe response frames, causing an out-of-bounds read in kernel memory, potentially leading to information disclosure or system crash.
Recommendation
Apply a Linux kernel update containing the fix that skips the IE lookup if the frame does not reach the variable elements.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() at76_guess_freq() checks only that the received frame is at least a bare 802.11 header (24 bytes) before subtracting the fixed management-body offset: len -= el_off; For both beacon and probe response frames, el_off is 36. If the frame is shorter than el_off, subtracting it causes the calculated IE length to wrap. The length is eventually passed to cfg80211_find_elem_match() as a very large unsigned value, so the element walk runs beyond the RX skb. This path is reached from at76_rx_tasklet() while scanning. If the device delivers a truncated beacon or probe response, the oversized IE length causes an out-of-bounds read during scanning. Skip the IE lookup if the frame does not reach the variable elements, before subtracting el_off.