CVE-2026-68344

Received Received - Intake

USB Descriptor Confusion in Linux Kernel USB ATM Driver

Publication date: 2026-08-10

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect uea_probe() distinguishes a pre-firmware device from a post-firmware one using the USB id (UEA_IS_PREFIRM()), and stores a different object as the interface data in each case: a 'struct completion' for a pre-firmware device (to be waited on in .disconnect()), or a 'struct usbatm_data' for a post-firmware one. uea_disconnect() instead tells the two apart by the number of interfaces of the active configuration (a pre-firmware device exposes a single interface, ADI930 has 2 and eagle has 3), and casts the interface data accordingly. Because the two handlers use different criteria, a crafted device that advertises a pre-firmware id together with a multi-interface descriptor (or a post-firmware id with a single interface) makes them disagree: the small 'struct completion' stored by uea_probe() is then passed to usbatm_usb_disconnect(), which casts it to 'struct usbatm_data' and takes instance->serialize, reading past the end of the allocation: BUG: KASAN: slab-out-of-bounds in __mutex_lock+0x152a/0x1b80 Read of size 8 at addr ffff8880470e2c60 by task kworker/1:2/982 ... __mutex_lock+0x152a/0x1b80 usbatm_usb_disconnect+0x70/0x820 uea_disconnect+0x133/0x2c0 usb_unbind_interface+0x1dd/0x9e0 ... which belongs to the cache kmalloc-96 of size 96 The buggy address is located 0 bytes to the right of allocated 96-byte region [ffff8880470e2c00, ffff8880470e2c60) Reject such inconsistent descriptors in uea_probe() so that both handlers always make the same pre/post-firmware decision.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-19

Generated

2026-08-30

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68344

EUVD

EUVD-2026-55445

Affected Vendors & Products

Vendor	Product	Version / Range
ueagle	ueagle-atm	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a mismatch in how the usb: atm: ueagle-atm driver determines whether a device is in pre-firmware or post-firmware state. The probe and disconnect functions use different criteria to make this determination, which can lead to a crafted device causing a memory corruption error when the wrong data structure is accessed.

Detection Guidance

This vulnerability affects the Linux kernel's usb atm ueagle-atm driver. Detection requires checking kernel logs for KASAN slab-out-of-bounds errors related to usbatm_usb_disconnect or uea_disconnect functions. Monitor dmesg for crashes during USB device disconnection.

Impact Analysis

This vulnerability could allow an attacker with physical access to a system to trigger a kernel memory corruption issue by plugging in a specially crafted USB device. This might lead to system crashes, data corruption, or potential privilege escalation, depending on the kernel's memory state at the time.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel driver issue causing memory corruption during USB device handling. Compliance impacts would only occur if this vulnerability were exploited to gain unauthorized access to system memory, potentially leading to data breaches. However, no evidence in the provided context suggests such exploitation scenarios.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-68344. Avoid using untrusted USB devices until patched. If immediate patching is not possible, disable the ueagle-atm module using modprobe -r ueagle-atm.

Hi! I’m here to help you understand CVE-2026-68344. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70