The at76c50x‑usb driver in the Linux kernel contains a flaw that triggers when a Wi‑Fi beacon or probe response frame is shorter than the offset used for parsing element lengths. The driver subtracts a fixed offset without first ensuring the frame is long enough, causing the calculated length to wrap to a very large unsigned value. This large value is then passed to a configuration routine that iterates over information elements, forcing an out‑of‑bounds read of the packet buffer and likely crashing the kernel. The resulting device restart or halt represents a denial‑of‑service condition, but the payload does not provide an attack path to remote code execution or data exfiltration. This condition is an example of a buffer under‑read (CWE‑125).

The vulnerability resides in the at76c50x‑usb driver compiled into the Linux kernel for Wi‑Fi devices that use the at76c50x chipset. No specific kernel versions are enumerated in the advisory, so any kernel build that includes the unpatched driver code is potentially impacted. Systems equipped with USB Wi‑Fi adapters powered by this chipset—for example, certain inexpensive dongles—are therefore at risk.

The CVSS score for this issue is 8.1, indicating a high severity, while the EPSS score is below 1%, suggesting a low probability of active exploitation. The flaw is not listed in CISA’s KEV catalog. The likely attack vector is a Wi‑Fi attacker transmitting malformed beacon or probe response frames within broadcast range to trigger the underflow. An attacker who can transmit such malformed frames within wireless range can cause an out‑of‑bounds read that leads to a kernel crash, interrupting device and system availability.