CVE-2026-68373 wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()
An integer underflow in the at76c50x-usb WiFi driver allows out-of-bounds reads during scanning, potentially causing information disclosure or system crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-68373?
CVE-2026-68373 is a high-severity vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()
at76_guess_freq() checks only that the received frame is at least a bare 802.11 header (24 bytes) before subtracting the fixed management-body offset:
len -= el_off;
For both beacon and probe response frames, el_off is 36. If the frame is shorter than el_off, subtracting it causes the calculated IE length to wrap. The length is eventually passed to cfg80211_find_elem_match() as a very large unsigned value, so the element walk runs beyond the RX skb.
This path is reached from at76_rx_tasklet() while scanning. If the device delivers a truncated beacon or probe response, the oversized IE length causes an out-of-bounds read during scanning.
Skip the IE lookup if the frame does not reach the variable elements, before subtracting el_off.
Weakness: CWE-190
Which versions are affected by CVE-2026-68373?
How do I fix CVE-2026-68373?
Apply the vendor's patch.
Is CVE-2026-68373 being exploited?
There is no known exploitation of CVE-2026-68373 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-68373, DEBIAN-CVE-2026-68373, GHSA-rhfx-w25m-wcjf, UBUNTU-CVE-2026-68373.