CVE-2026-68373

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds read occurs during scanning when the device delivers a truncated beacon or probe response frame. The at76 guess freq() function only verifies that the received frame is at least 24 bytes before subtracting a fixed management-body offset el off (which is 36 bytes). If the frame is shorter than el off, a length underflow occurs, causing the calculated Information Element (IE) length to wrap into a very large unsigned value. This value is then passed to cfg80211 find elem match(), leading the element walk to run beyond the RX skb (socket buffer). This execution path is triggered from at76 rx tasklet().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.