CVE-2026-68373wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() at76_guess_freq() checks only that the received frame is at least a bare 802.11 header (24 bytes) before subtracting the fixed management-body offset: len -= el_off; For both beacon and probe response frames, el_off is 36. If the frame is shorter than el_off, subtracting it causes the calculated IE length to wrap. The length is eventually passed to cfg80211_find_elem_match() as a very large unsigned value, so the element walk runs beyond the RX skb. This path is reached from at76_rx_tasklet() while scanning. If the device delivers a truncated beacon or probe response, the oversized IE length causes an out-of-bounds read during scanning. Skip the IE lookup if the frame does not reach the variable elements, before subtracting el_off.
- CVSS
- 8.1 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 1264b951463a00efebe1bb596499aaad620ec8af before cb831aff2f850f72bc5ff5ad77d0a70bb5a84061; from 1264b951463a00efebe1bb596499aaad620ec8af before 4875680d1703f56afa6257ba30244f2fb44ed205; from 1264b951463a00efebe1bb596499aaad620ec8af before b406f33d234f98c8b310fdab5cbb492d85e98e49; from 1264b951463a00efebe1bb596499aaad620ec8af before e165a1d295e7e814e13b0f92c86e5d48309509ce; from 1264b951463a00efebe1bb596499aaad620ec8af before bcde7249d45f52f994a9872bedf45994472ade77; from 1264b951463a00efebe1bb596499aaad620ec8af before fb1b50ab699211e777dca5ccfb648788b6a6e519; from 1264b951463a00efebe1bb596499aaad620ec8af before f742d9c98b5c504fc9e6744eef13a721c2aea486; 1264b951463a00efebe1bb596499aaad620ec8af builds before 61a799ffd1e5a4fd3702d547828b7ff3d161468e | CNA record |
References
- https://git.kernel.org/stable/c/cb831aff2f850f72bc5ff5ad77d0a70bb5a84061
- https://git.kernel.org/stable/c/4875680d1703f56afa6257ba30244f2fb44ed205
- https://git.kernel.org/stable/c/b406f33d234f98c8b310fdab5cbb492d85e98e49
- https://git.kernel.org/stable/c/e165a1d295e7e814e13b0f92c86e5d48309509ce
- https://git.kernel.org/stable/c/bcde7249d45f52f994a9872bedf45994472ade77
- https://git.kernel.org/stable/c/fb1b50ab699211e777dca5ccfb648788b6a6e519
- https://git.kernel.org/stable/c/f742d9c98b5c504fc9e6744eef13a721c2aea486
- https://git.kernel.org/stable/c/61a799ffd1e5a4fd3702d547828b7ff3d161468e
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.