CVE-2026-68327

Received Received - Intake

WANXL Hardware Reset Null Pointer Dereference in Linux Kernel

Publication date: 2026-08-10

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: wan: wanxl: Only reset hardware after BAR mapping wanxl_pci_init_one() stores the freshly allocated card in driver data before the PLX BAR is mapped. Several early probe failures then unwind through wanxl_pci_remove_one(), including failure to allocate the coherent status area or to restore the DMA mask. wanxl_pci_remove_one() unconditionally calls wanxl_reset(), and wanxl_reset() dereferences card->plx. On those early failures card->plx is still NULL, so the error path can dereference a NULL MMIO pointer. Only issue the hardware reset once the BAR mapping exists. The remaining cleanup in wanxl_pci_remove_one() already checks whether later resources were allocated. This issue was found by a static analysis checker and confirmed by manual source review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-19

Generated

2026-08-30

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68327

EUVD

EUVD-2026-55428

Affected Vendors & Products

Vendor	Product	Version / Range
wan	wanxl	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a race condition during the initialization of the wanxl WAN card driver. The issue occurs when wanxl_pci_init_one() stores the card structure before the PCI BAR (Base Address Register) is mapped. If probe failures happen early, wanxl_pci_remove_one() calls wanxl_reset(), which tries to access a NULL pointer (card->plx) due to the unmapped BAR, leading to a NULL pointer dereference in MMIO operations.

Detection Guidance

This vulnerability is specific to the Linux kernel's wanxl driver and may not have direct detection commands. Check if the wanxl driver is loaded using 'lsmod | grep wanxl'. If loaded, verify kernel logs for probe failures with 'dmesg | grep wanxl'.

Impact Analysis

This vulnerability could cause system crashes or instability during the initialization or removal of the wanxl WAN card driver. It may lead to kernel panics or denial-of-service conditions if the driver fails to handle early probe errors properly.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level kernel hardware issue involving NULL pointer dereferencing during early probe failures in the wanxl driver. Compliance impacts would depend on system-specific configurations and compensating controls rather than this specific flaw.

Mitigation Strategies

Update the Linux kernel to a patched version where this issue is resolved. If using a vulnerable kernel, avoid loading the wanxl driver or unload it with 'rmmod wanxl' until patched.

Hi! I’m here to help you understand CVE-2026-68327. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70