CVE-2026-68373 (GCVE-0-2026-68373)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:03 – Updated: 2026-08-19 16:34
VLAI
Title
wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() at76_guess_freq() checks only that the received frame is at least a bare 802.11 header (24 bytes) before subtracting the fixed management-body offset: len -= el_off; For both beacon and probe response frames, el_off is 36. If the frame is shorter than el_off, subtracting it causes the calculated IE length to wrap. The length is eventually passed to cfg80211_find_elem_match() as a very large unsigned value, so the element walk runs beyond the RX skb. This path is reached from at76_rx_tasklet() while scanning. If the device delivers a truncated beacon or probe response, the oversized IE length causes an out-of-bounds read during scanning. Skip the IE lookup if the frame does not reach the variable elements, before subtracting el_off.
Severity
8.1 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1264b951463a00efebe1bb596499aaad620ec8af , < cb831aff2f850f72bc5ff5ad77d0a70bb5a84061 (git)
Affected: 1264b951463a00efebe1bb596499aaad620ec8af , < 4875680d1703f56afa6257ba30244f2fb44ed205 (git)
Affected: 1264b951463a00efebe1bb596499aaad620ec8af , < b406f33d234f98c8b310fdab5cbb492d85e98e49 (git)
Affected: 1264b951463a00efebe1bb596499aaad620ec8af , < e165a1d295e7e814e13b0f92c86e5d48309509ce (git)
Affected: 1264b951463a00efebe1bb596499aaad620ec8af , < bcde7249d45f52f994a9872bedf45994472ade77 (git)
Affected: 1264b951463a00efebe1bb596499aaad620ec8af , < fb1b50ab699211e777dca5ccfb648788b6a6e519 (git)
Affected: 1264b951463a00efebe1bb596499aaad620ec8af , < f742d9c98b5c504fc9e6744eef13a721c2aea486 (git)
Affected: 1264b951463a00efebe1bb596499aaad620ec8af , < 61a799ffd1e5a4fd3702d547828b7ff3d161468e (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.30
Unaffected: 0 , < 2.6.30 (semver)
Unaffected: 5.10.265 , ≤ 5.10.* (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/atmel/at76c50x-usb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cb831aff2f850f72bc5ff5ad77d0a70bb5a84061",
              "status": "affected",
              "version": "1264b951463a00efebe1bb596499aaad620ec8af",
              "versionType": "git"
            },
            {
              "lessThan": "4875680d1703f56afa6257ba30244f2fb44ed205",
              "status": "affected",
              "version": "1264b951463a00efebe1bb596499aaad620ec8af",
              "versionType": "git"
            },
            {
              "lessThan": "b406f33d234f98c8b310fdab5cbb492d85e98e49",
              "status": "affected",
              "version": "1264b951463a00efebe1bb596499aaad620ec8af",
              "versionType": "git"
            },
            {
              "lessThan": "e165a1d295e7e814e13b0f92c86e5d48309509ce",
              "status": "affected",
              "version": "1264b951463a00efebe1bb596499aaad620ec8af",
              "versionType": "git"
            },
            {
              "lessThan": "bcde7249d45f52f994a9872bedf45994472ade77",
              "status": "affected",
              "version": "1264b951463a00efebe1bb596499aaad620ec8af",
              "versionType": "git"
            },
            {
              "lessThan": "fb1b50ab699211e777dca5ccfb648788b6a6e519",
              "status": "affected",
              "version": "1264b951463a00efebe1bb596499aaad620ec8af",
              "versionType": "git"
            },
            {
              "lessThan": "f742d9c98b5c504fc9e6744eef13a721c2aea486",
              "status": "affected",
              "version": "1264b951463a00efebe1bb596499aaad620ec8af",
              "versionType": "git"
            },
            {
              "lessThan": "61a799ffd1e5a4fd3702d547828b7ff3d161468e",
              "status": "affected",
              "version": "1264b951463a00efebe1bb596499aaad620ec8af",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/atmel/at76c50x-usb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.30"
            },
            {
              "lessThan": "2.6.30",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: at76c50x-usb: avoid length underflow in at76_guess_freq()\n\nat76_guess_freq() checks only that the received frame is at least a bare\n802.11 header (24 bytes) before subtracting the fixed management-body\noffset:\n\n\tlen -= el_off;\n\nFor both beacon and probe response frames, el_off is 36. If the frame is\nshorter than el_off, subtracting it causes the calculated IE length to\nwrap. The length is eventually passed to cfg80211_find_elem_match() as a\nvery large unsigned value, so the element walk runs beyond the RX skb.\n\nThis path is reached from at76_rx_tasklet() while scanning. If the device\ndelivers a truncated beacon or probe response, the oversized IE length\ncauses an out-of-bounds read during scanning.\n\nSkip the IE lookup if the frame does not reach the variable elements,\nbefore subtracting el_off."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The malformed frame is an over-the-air 802.11 beacon or probe response received by the at76c50x USB WLAN dongle and parsed in at76_rx_tasklet(); an attacker only needs to be within radio range of the victim, which is the adjacent-network (WiFi frame injection) case.\nAC:L - The attacker simply transmits a beacon/probe response whose body is shorter than the 36-byte fixed management offset with a valid FCS, and can repeat it continuously or answer the victim\u0027s probe requests during the routine scans that set priv-\u003escanning, so triggering is reliable and fully attacker-timed.\nPR:N - No authentication, association, or any local privilege is required; the frame is parsed during scanning before any association or key exchange, so an entirely unauthenticated radio-range attacker reaches the bug.\nUI:N - Background and periodic scans are issued automatically by wpa_supplicant/NetworkManager without any user action, so no victim interaction is needed for the vulnerable path to run.\nS:U - The out-of-bounds read stays within the kernel\u0027s own memory and security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The underflowed length becomes ~4GB when widened to unsigned int, so the element walk reads far past the ~2.5KB RX skb slab object, and the out-of-bounds byte taken as el[2] is turned into rx_status.freq that userspace observes in scan results, allowing repeated frames to leak adjacent kernel heap contents.\nI:N - The defect is purely a read overrun; nothing outside the skb is written and the only attacker-influenced value is the reported channel/frequency, giving no memory-corruption or control-flow primitive.\nA:H - The unbounded element walk runs off the slab and can dereference unmapped memory while executing in tasklet/softirq context, producing a kernel oops or panic that the attacker can trigger repeatedly with injected frames."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:34:33.308Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cb831aff2f850f72bc5ff5ad77d0a70bb5a84061"
        },
        {
          "url": "https://git.kernel.org/stable/c/4875680d1703f56afa6257ba30244f2fb44ed205"
        },
        {
          "url": "https://git.kernel.org/stable/c/b406f33d234f98c8b310fdab5cbb492d85e98e49"
        },
        {
          "url": "https://git.kernel.org/stable/c/e165a1d295e7e814e13b0f92c86e5d48309509ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/bcde7249d45f52f994a9872bedf45994472ade77"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb1b50ab699211e777dca5ccfb648788b6a6e519"
        },
        {
          "url": "https://git.kernel.org/stable/c/f742d9c98b5c504fc9e6744eef13a721c2aea486"
        },
        {
          "url": "https://git.kernel.org/stable/c/61a799ffd1e5a4fd3702d547828b7ff3d161468e"
        }
      ],
      "title": "wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68373",
    "datePublished": "2026-08-10T12:03:51.663Z",
    "dateReserved": "2026-07-30T09:28:09.386Z",
    "dateUpdated": "2026-08-19T16:34:33.308Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68373",
      "date": "2026-09-21",
      "epss": "0.00277",
      "percentile": "0.20394"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/atmel/at76c50x-usb.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "cb831aff2f850f72bc5ff5ad77d0a70bb5a84061",
                    "status": "affected",
                    "version": "1264b951463a00efebe1bb596499aaad620ec8af",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4875680d1703f56afa6257ba30244f2fb44ed205",
                    "status": "affected",
                    "version": "1264b951463a00efebe1bb596499aaad620ec8af",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b406f33d234f98c8b310fdab5cbb492d85e98e49",
                    "status": "affected",
                    "version": "1264b951463a00efebe1bb596499aaad620ec8af",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e165a1d295e7e814e13b0f92c86e5d48309509ce",
                    "status": "affected",
                    "version": "1264b951463a00efebe1bb596499aaad620ec8af",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bcde7249d45f52f994a9872bedf45994472ade77",
                    "status": "affected",
                    "version": "1264b951463a00efebe1bb596499aaad620ec8af",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fb1b50ab699211e777dca5ccfb648788b6a6e519",
                    "status": "affected",
                    "version": "1264b951463a00efebe1bb596499aaad620ec8af",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f742d9c98b5c504fc9e6744eef13a721c2aea486",
                    "status": "affected",
                    "version": "1264b951463a00efebe1bb596499aaad620ec8af",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "61a799ffd1e5a4fd3702d547828b7ff3d161468e",
                    "status": "affected",
                    "version": "1264b951463a00efebe1bb596499aaad620ec8af",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/atmel/at76c50x-usb.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.30"
                  },
                  {
                    "lessThan": "2.6.30",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.265",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.216",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.183",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.148",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.101",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.42",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: at76c50x-usb: avoid length underflow in at76_guess_freq()\n\nat76_guess_freq() checks only that the received frame is at least a bare\n802.11 header (24 bytes) before subtracting the fixed management-body\noffset:\n\n\tlen -= el_off;\n\nFor both beacon and probe response frames, el_off is 36. If the frame is\nshorter than el_off, subtracting it causes the calculated IE length to\nwrap. The length is eventually passed to cfg80211_find_elem_match() as a\nvery large unsigned value, so the element walk runs beyond the RX skb.\n\nThis path is reached from at76_rx_tasklet() while scanning. If the device\ndelivers a truncated beacon or probe response, the oversized IE length\ncauses an out-of-bounds read during scanning.\n\nSkip the IE lookup if the frame does not reach the variable elements,\nbefore subtracting el_off."
          }
        ],
        "id": "CVE-2026-68373",
        "lastModified": "2026-08-19T17:20:46.770",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-10T13:20:30.190",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4875680d1703f56afa6257ba30244f2fb44ed205"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/61a799ffd1e5a4fd3702d547828b7ff3d161468e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b406f33d234f98c8b310fdab5cbb492d85e98e49"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bcde7249d45f52f994a9872bedf45994472ade77"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cb831aff2f850f72bc5ff5ad77d0a70bb5a84061"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e165a1d295e7e814e13b0f92c86e5d48309509ce"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f742d9c98b5c504fc9e6744eef13a721c2aea486"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fb1b50ab699211e777dca5ccfb648788b6a6e519"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-26T13:40:02+00:00",
      "cve": "CVE-2026-68373",
      "id": "CVE-2026-68373",
      "initial_release_date": "2026-08-10T12:03:51.663000+00:00",
      "product_status:known_not_affected": "276",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Out-of-bounds read in wifi driver due to length underflow",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68373.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T00:31:08Z",
      "cve": "CVE-2026-68373",
      "id": "CVE-2026-68373",
      "initial_release_date": "2026-08-14T17:13:43Z",
      "product_status:known_affected": "675",
      "product_status:known_not_affected": "56",
      "product_status:recommended": "107",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68373",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68373.json",
      "version": "10"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.