CVE-2026-68373: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-68373 Overview

CVE-2026-68373 is an out-of-bounds read vulnerability in the Linux kernel's at76c50x-usb Wi-Fi driver. The flaw resides in the at76_guess_freq() function, which improperly validates frame lengths before subtracting a fixed management-body offset. When the driver processes a truncated beacon or probe response frame during scanning, an integer underflow causes the information element (IE) length to wrap to a very large unsigned value. That value is then passed to cfg80211_find_elem_match(), causing the element walk to read past the receive skb buffer.

Critical Impact
An adjacent-network attacker within Wi-Fi range can trigger an out-of-bounds read in kernel memory by transmitting a crafted, truncated 802.11 management frame, potentially causing a kernel crash or information disclosure.

Affected Products

Linux kernel at76c50x-usb wireless USB driver
Systems using Atmel AT76C50x USB Wi-Fi adapters
Multiple stable Linux kernel branches (patches backported across five stable trees)

Discovery Timeline

2026-08-10 - CVE-2026-68373 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68373

Vulnerability Analysis

The vulnerability is an integer underflow leading to an out-of-bounds read [CWE-125, CWE-191]. The at76_guess_freq() function in the at76c50x-usb driver inspects incoming 802.11 management frames to determine the operating channel. It validates only that the received frame is at least the size of a bare 802.11 header (24 bytes) before proceeding.

For beacon and probe response frames, the driver then subtracts a fixed management-body offset (el_off) of 36 bytes to reach the variable IE section. When a frame is longer than 24 bytes but shorter than 36 bytes, the subtraction len -= el_off underflows the unsigned length variable, producing a value near SIZE_MAX.

Root Cause

The root cause is missing bounds validation between two length checks. The initial guard verifies only the fixed 802.11 header size, not the additional fixed portion of the management frame body required before the variable elements begin. The unsigned arithmetic then wraps silently, and no subsequent check catches the anomalous length.

Attack Vector

The attack path is reached from at76_rx_tasklet() during scanning. An attacker on the adjacent Wi-Fi network transmits a malformed beacon or probe response that is smaller than 36 bytes past the 802.11 header. The oversized IE length passed to cfg80211_find_elem_match() causes the element walk to iterate well beyond the receive skb, reading unrelated kernel memory. The result is a probable kernel panic and potential leakage of adjacent memory contents to log paths or subsequent processing. User interaction is not required; the victim only needs to be scanning for networks. See the upstream fix commit for the corrective patch.

Detection Methods for CVE-2026-68373

Indicators of Compromise

Unexpected kernel oops, KASAN slab-out-of-bounds reports, or panics referencing at76_guess_freq, at76_rx_tasklet, or cfg80211_find_elem_match in dmesg or journalctl output.
Repeated Wi-Fi interface resets or USB device disconnects on hosts using AT76C50x-based adapters during network scans.
Presence of the at76c50x_usb kernel module loaded on unpatched hosts in environments where wireless scanning is active.

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test systems to surface the out-of-bounds read during fuzzing of 802.11 management frames.
Correlate kernel crash dumps and stack traces containing at76_* symbols with wireless-adjacent activity to identify targeted exploitation attempts.
Inventory endpoints and IoT devices using the at76c50x-usb module and flag those running kernel builds prior to the fix commits.

Monitoring Recommendations

Forward kernel logs, crash reports, and USB device events to a centralized logging platform for correlation and retrospective search.
Monitor for anomalous 802.11 management frame sizes on wireless intrusion detection systems, focusing on beacons and probe responses smaller than typical minimums.
Track loaded kernel module inventories across the fleet to identify assets still exposing the vulnerable driver after patch cycles.

How to Mitigate CVE-2026-68373

Immediate Actions Required

Apply the latest stable Linux kernel updates from your distribution that include the at76c50x-usb fixes referenced in the upstream commits.
Unload or blacklist the at76c50x_usb kernel module on systems that do not require the driver, particularly in laptops, embedded devices, and IoT gateways.
Restrict Wi-Fi scanning on affected hosts operating in untrusted RF environments until patches are deployed.

Patch Information

The fix modifies at76_guess_freq() to verify that the frame actually reaches the variable elements before subtracting el_off. Five upstream commits carry the correction across mainline and stable branches: 61a799ff, bcde7249, e165a1d2, f742d9c9, and fb1b50ab. Distribution kernels rebased on these commits eliminate the underflow path.

Workarounds

Blacklist the driver by adding blacklist at76c50x_usb to /etc/modprobe.d/ and rebuilding the initramfs where applicable.
Physically remove or disable USB Wi-Fi adapters based on the Atmel AT76C50x chipset until the kernel is updated.
Disable wireless interfaces in environments where the vulnerable driver cannot be immediately replaced or patched.

bash

# Prevent the vulnerable driver from loading
echo "blacklist at76c50x_usb" | sudo tee /etc/modprobe.d/blacklist-at76c50x.conf
sudo rmmod at76c50x_usb 2>/dev/null || true
sudo update-initramfs -u