CVE-2026-68373 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()
at76_guess_freq() checks only that the received frame is at least a bare 802.11 header (24 bytes) before subtracting the fixed management-body offset:
len -= el_off;
For both beacon and probe response frames, el_off is 36. If the frame is shorter than el_off, subtracting it causes the calculated IE length to wrap. The length is eventually passed to cfg80211_find_elem_match() as a very large unsigned value, so the element walk runs beyond the RX skb.
This path is reached from at76_rx_tasklet() while scanning. If the device delivers a truncated beacon or probe response, the oversized IE length causes an out-of-bounds read during scanning.
Skip the IE lookup if the frame does not reach the variable elements, before subtracting el_off.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability exists within the Linux kernel's wireless subsystem specifically in the at76c50x-usb driver implementation where a length underflow condition can occur during wireless frame processing. This flaw manifests in the at76_guess_freq() function which handles management frame parsing for wireless network scanning operations. The issue arises from inadequate input validation before performing arithmetic operations on frame length values, creating a scenario where malicious or corrupted wireless frames can trigger unexpected behavior in the kernel's wireless driver.
The technical root cause stems from insufficient boundary checking within the frame processing logic where the function validates that received frames contain at least 24 bytes for basic 802.11 headers but fails to verify whether the frame length exceeds the expected management body offset value of 36 bytes used for beacon and probe response frames. When a frame shorter than this offset is processed, the subtraction operation len -= el_off; results in unsigned integer underflow, producing an extremely large positive value that subsequently propagates through the system as a malformed IE (Information Element) length parameter.
This vulnerability operates under the context of wireless scanning operations where the at76_rx_tasklet() function processes received frames during network discovery. The improper handling allows truncated beacon or probe response frames to cause the cfg80211_find_elem_match() function to iterate far beyond the actual frame boundaries, leading to out-of-bounds memory reads that can potentially expose kernel memory contents or cause system instability. The flaw represents a classic buffer overflow condition that has been categorized under CWE-129 Input Validation and Output Processing, specifically manifesting as an improper limitation of a recognized operating range.
The operational impact of this vulnerability extends beyond simple memory corruption as it enables potential privilege escalation and information disclosure attacks. Attackers can craft malicious wireless frames that trigger the underflow condition during normal scanning operations, potentially allowing them to read kernel memory locations or cause denial-of-service conditions. The vulnerability affects systems running Linux kernels with the at76c50x-usb wireless driver implementation and operates within the ATT&CK framework category of privilege escalation through kernel exploits.
Mitigation strategies should focus on implementing proper input validation before arithmetic operations, specifically ensuring that frame lengths are verified against expected minimum values before performing offset calculations. The fix requires modifying the at76_guess_freq() function to check whether the received frame length is sufficient to contain the variable elements before attempting to subtract the fixed management body offset. This approach prevents the unsigned integer underflow condition and ensures that memory access operations remain within legitimate bounds, effectively neutralizing the out-of-bounds read vulnerability during wireless scanning operations.