Skip to main content

Linux Kernel CVE-2026-68373

| EUVDEUVD-2026-55559 HIGH
2026-08-10 Linux GHSA-rhfx-w25m-wcjf
Buffer Overflow Linux
8.1
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.1 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
8.1 HIGH

Adjacent-only reach (WiFi radio range); no authentication required per passive RX path; OOB read yields kernel memory leak (C:H) and potential panic (A:H); no write primitive so I:N.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 03:00 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
8.1 (HIGH)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 12:03 cve.org
HIGH 8.1
CVE Published
Aug 10, 2026 - 12:03 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()

at76_guess_freq() checks only that the received frame is at least a bare 802.11 header (24 bytes) before subtracting the fixed management-body offset:

len -= el_off;

For both beacon and probe response frames, el_off is 36. If the frame is shorter than el_off, subtracting it causes the calculated IE length to wrap. The length is eventually passed to cfg80211_find_elem_match() as a very large unsigned value, so the element walk runs beyond the RX skb.

This path is reached from at76_rx_tasklet() while scanning. If the device delivers a truncated beacon or probe response, the oversized IE length causes an out-of-bounds read during scanning.

Skip the IE lookup if the frame does not reach the variable elements, before subtracting el_off.

AnalysisAI

Out-of-bounds kernel memory read in the at76c50x-usb WiFi driver affects Linux systems equipped with Atmel AT76C50x USB wireless adapters. When the kernel scans for networks, a truncated beacon or probe response frame between 24 and 35 bytes triggers an integer underflow in at76_guess_freq(): subtracting the fixed management-body offset (el_off = 36) from a shorter frame length wraps the unsigned value to near UINT_MAX, which is then passed to cfg80211_find_elem_match(), causing a walk far beyond the RX socket buffer boundary with consequences ranging from kernel memory disclosure to system crash. With an EPSS of 0.17% (6th percentile) and no CISA KEV listing, no public exploit identified at time of analysis, though the AV:A/PR:N vector means any adjacent attacker can trigger the condition without authentication during routine scanning.

Technical ContextAI

The at76c50x-usb driver (cpe:2.3:a:linux:linux:*) supports the Atmel AT76C50x family of legacy USB 802.11b WiFi chipsets introduced into the kernel with commit 1264b951463a00efebe1bb596499aaad620ec8af in Linux 2.6.30. The vulnerable function at76_guess_freq() is invoked from at76_rx_tasklet() during WiFi scanning to classify received 802.11 management frames. For beacon and probe response subtypes, it sets el_off to 36 - the 24-byte 802.11 MAC header plus 12 bytes of fixed management body fields (timestamp, beacon interval, capability info) - before iterating over information elements (IEs). The code validates only that the frame is at least 24 bytes but does not enforce the additional 12 bytes required before executing len -= el_off. When len is between 24 and 35, C unsigned arithmetic wraps the result to approximately 4,294,967,260, and this inflated length is forwarded to cfg80211_find_elem_match(), which iterates IEs using the oversized bound, reading far beyond the actual skb buffer. No CWE is formally assigned in the input; the root cause is CWE-191 (Integer Underflow/Wrap) directly inducing CWE-125 (Out-of-Bounds Read) in kernel context.

RemediationAI

Upgrade to a patched stable kernel: Linux 6.6.148, 6.12.101, 6.18.42, 7.1.6, or 7.2-rc5 depending on your stable branch; fix commits are published at https://git.kernel.org/stable/c/e165a1d295e7e814e13b0f92c86e5d48309509ce and the four sibling commits in the references. If an immediate kernel upgrade is not feasible and the AT76C50x hardware is not actively required, the most effective compensating control is to blacklist the module by adding 'blacklist at76c50x_usb' to /etc/modprobe.d/blacklist.conf and rebooting - this eliminates the attack surface entirely at the cost of disabling the associated WiFi adapter. If the adapter must remain active, physically or administratively isolating the machine from untrusted RF environments (e.g., disabling WiFi scanning via NetworkManager policy or operating only in managed infrastructure) reduces but does not eliminate risk, since the vulnerability triggers on any received truncated frame during normal scanning behavior. No generic network-layer firewall rule can block this vector, as the attack is delivered over raw 802.11 frames.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2026-68373 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy