GHSA-RHFX-W25M-WCJF

Vulnerability from github – Published: 2026-08-10 15:33 – Updated: 2026-08-19 18:32
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()

at76_guess_freq() checks only that the received frame is at least a bare 802.11 header (24 bytes) before subtracting the fixed management-body offset:

len -= el_off;

For both beacon and probe response frames, el_off is 36. If the frame is shorter than el_off, subtracting it causes the calculated IE length to wrap. The length is eventually passed to cfg80211_find_elem_match() as a very large unsigned value, so the element walk runs beyond the RX skb.

This path is reached from at76_rx_tasklet() while scanning. If the device delivers a truncated beacon or probe response, the oversized IE length causes an out-of-bounds read during scanning.

Skip the IE lookup if the frame does not reach the variable elements, before subtracting el_off.

Severity
8.1 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-68373"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-10T13:20:30Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: at76c50x-usb: avoid length underflow in at76_guess_freq()\n\nat76_guess_freq() checks only that the received frame is at least a bare\n802.11 header (24 bytes) before subtracting the fixed management-body\noffset:\n\n\tlen -= el_off;\n\nFor both beacon and probe response frames, el_off is 36. If the frame is\nshorter than el_off, subtracting it causes the calculated IE length to\nwrap. The length is eventually passed to cfg80211_find_elem_match() as a\nvery large unsigned value, so the element walk runs beyond the RX skb.\n\nThis path is reached from at76_rx_tasklet() while scanning. If the device\ndelivers a truncated beacon or probe response, the oversized IE length\ncauses an out-of-bounds read during scanning.\n\nSkip the IE lookup if the frame does not reach the variable elements,\nbefore subtracting el_off.",
  "id": "GHSA-rhfx-w25m-wcjf",
  "modified": "2026-08-19T18:32:17Z",
  "published": "2026-08-10T15:33:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68373"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4875680d1703f56afa6257ba30244f2fb44ed205"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/61a799ffd1e5a4fd3702d547828b7ff3d161468e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b406f33d234f98c8b310fdab5cbb492d85e98e49"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bcde7249d45f52f994a9872bedf45994472ade77"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cb831aff2f850f72bc5ff5ad77d0a70bb5a84061"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e165a1d295e7e814e13b0f92c86e5d48309509ce"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f742d9c98b5c504fc9e6744eef13a721c2aea486"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fb1b50ab699211e777dca5ccfb648788b6a6e519"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.