Cloudanix VulnDB

CVE-2026-68373

High · 8.1

CVSS

8.1

EPSS

0.3%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in certain older Linux Wi-Fi drivers can let a nearby attacker crash the system or read memory during routine wireless scanning.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
Low
Impact
Data Exposure
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Integer underflow in at76_guess_freq() during 802.11 beacon/probe-response parsing causes cfg80211_find_elem_match() to receive an oversized length, resulting in out-of-bounds read from the RX skb while scanning.

Why it matters to the business

Wireless scanning on affected Linux systems can trigger memory corruption, leading to kernel crashes, denial of service, or potential information disclosure; 76 days after disclosure the exploit probability remains low and continues to decline.

How an attack unfolds

An attacker within radio range transmits truncated 802.11 management frames (beacon or probe response shorter than 36 bytes) that reach at76_rx_tasklet(); the length underflow produces a huge IE length passed to the element walker, causing an out-of-bounds read during active scanning.

How to fix it

Apply the upstream fix that adds an explicit length check before subtracting el_off and skips IE lookup for frames that do not contain the variable elements; rebuild and deploy the patched kernel on all affected systems.

How to confirm the fix worked

Confirm the kernel source contains the added length guard before the el_off subtraction; recompile, boot the new kernel, and verify that short management frames no longer produce OOB reads during scanning.

Typical attack path

  1. Position device within range of target Wi-Fi interface
  2. Transmit malformed short beacon or probe-response frames
  3. Trigger at76_rx_tasklet() path that calls at76_guess_freq()
  4. Force length underflow and oversized IE length argument
  5. Induce out-of-bounds read in cfg80211_find_elem_match()

How to detect it

Inspect kernel logs for oops/panic traces containing at76_rx_tasklet, at76_guess_freq, or cfg80211_find_elem_match; correlate with Wi-Fi interface activity and unusually short management frames observed on the air.

What your security team should do

  • Patch all systems running the at76c50x-usb driver to the fixed kernel version
  • Disable the driver or restrict scanning if immediate patching is impossible
  • Monitor for kernel oops or panic logs originating from at76_rx_tasklet

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() at76_guess_freq() checks only that the received frame is at least a bare 802.11 header (24 bytes) before subtracting the fixed management-body offset: len -= el_off; For both beacon and probe response frames, el_off is 36. If the frame is shorter than el_off, subtracting it causes the calculated IE length to wrap. The length is eventually passed to cfg80211_find_elem_match() as a very large unsigned value, so the element walk runs beyond the RX skb. This path is reached from at76_rx_tasklet() while scanning. If the device delivers a truncated beacon or probe response, the oversized IE length causes an out-of-bounds read during scanning. Skip the IE lookup if the frame does not reach the variable elements, before subtracting el_off.

Affected packages

Ecosystem Package Introduced Fixed