usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect
In the Linux kernel, the following vulnerability has been resolved: usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect uea_probe() distinguishes a pre-firmware device from a post-firmware one using the USB id (UEA_IS_PREFIRM()), and stores a different object as the interface data in each case: a 'struct completion' for a pre-firmware device (to be waited on in .disconnect()), or a 'struct usbatm_data' for a post-firmware one. uea_disconnect() instead tells the two apart by the number of interfaces of the active configuration (a pre-firmware device exposes a single interface, ADI930 has 2 and eagle has 3), and casts the interface data accordingly. Because the two handlers use different criteria, a crafted device that advertises a pre-firmware id together with a multi-interface descriptor (or a post-firmware id with a single interface) makes them disagree: the small 'struct completion' stored by uea_probe() is then passed to usbatm_usb_disconnect(), which casts it to 'struct usbatm_data' and takes instance->serialize, reading past the end of the allocation: BUG: KASAN: slab-out-of-bounds in __mutex_lock+0x152a/0x1b80 Read of size 8 at addr ffff8880470e2c60 by task kworker/1:2/982 ... __mutex_lock+0x152a/0x1b80 usbatm_usb_disconnect+0x70/0x820 uea_disconnect+0x133/0x2c0 usb_unbind_interface+0x1dd/0x9e0 ... which belongs to the cache kmalloc-96 of size 96 The buggy address is located 0 bytes to the right of allocated 96-byte region [ffff8880470e2c00, ffff8
CVE-2026-68344
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:CVE-2026-68344
Kernel
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 5.10.265
Source reference:
/affected/1/ranges5.15.216Source reference:
/affected/1/ranges6.1.183Source reference:
/affected/1/ranges6.6.148Source reference:
/affected/1/ranges6.12.101Source reference:
/affected/1/ranges6.18.42Source reference:
/affected/1/ranges7.1.6Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "d85f19aaef42a03e3e4765d659c761c8750a7f23"
},
{
"fixed": "9e7312844429379108ea9523a5ed934f142bb177"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "76861031b43a18065d13f9ffb8595d25c7576005"
},
{
"fixed": "f92832262718443feb4e5df2bf70424ba842629e"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "bbfedc84714064ea4845e6b76f96316eb5bb65d8"
},
{
"fixed": "e814ae925f6f575325124c29dde518b92c822b83"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "f2a6abc670104fc3e383ee3b1cf35c070485e3df"
},
{
"fixed": "c035b1198906dd5bd3df9a3045b59254bad1ea7a"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "c581e30ae5b332d8acef64475a211b3f82099941"
},
{
"fixed": "9904a46401198872ab3de34fd11f383831ef3428"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "509b51327320bdeaef1969248177a446ded073ab"
},
{
"fixed": "d0a57f19fe2865b9747484f5f9c631f944ed9a0f"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "ddcdac47e1f2651c7be60e299f98faf981522797"
},
{
"fixed": "0cc0c4c14150bb5a16b88dd61368f96cd4caa9ce"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "e2674dfbed8a30d57e2bc872c4bfa6c3eec918bf"
},
{
"fixed": "71132cedd1ecbc4032d76e9928c18a10f7e39b80"
}
]
}
],
"versions": [
"v5.10.264",
"v5.10.263",
"v5.10.262",
"v5.10.261",
"v5.15.215",
"v5.15.214",
"v5.15.213",
"v5.15.212",
"v6.1.182",
"v6.1.181",
"v6.1.180",
"v6.1.179",
"v6.1.178",
"v6.6.147",
"v6.6.146",
"v6.6.145",
"v6.12.100",
"v6.12.99",
"v6.12.98",
"v6.12.97",
"v6.18.41",
"v6.18.40",
"v7.1.5"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68344.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.10.261"
},
{
"fixed": "5.10.265"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.15.212"
},
{
"fixed": "5.15.216"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.1.178"
},
{
"fixed": "6.1.183"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.6.145"
},
{
"fixed": "6.6.148"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.12.97"
},
{
"fixed": "6.12.101"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.18.40"
},
{
"fixed": "6.18.42"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.1.5"
},
{
"fixed": "7.1.6"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68344.json"
}
}
]- Related CVEs
- CVE-2026-68344
Source reference:
/id
Publisher severity
No explicit severity was provided.
- Event
- #50795 · Revision 1
- Added to Heist Feed
- Publisher date