GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2026-68344

Vulnerability from fkie_nvd - Published: 2026-08-10 13:20 - Updated: 2026-08-19 17:20
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect uea_probe() distinguishes a pre-firmware device from a post-firmware one using the USB id (UEA_IS_PREFIRM()), and stores a different object as the interface data in each case: a 'struct completion' for a pre-firmware device (to be waited on in .disconnect()), or a 'struct usbatm_data' for a post-firmware one. uea_disconnect() instead tells the two apart by the number of interfaces of the active configuration (a pre-firmware device exposes a single interface, ADI930 has 2 and eagle has 3), and casts the interface data accordingly. Because the two handlers use different criteria, a crafted device that advertises a pre-firmware id together with a multi-interface descriptor (or a post-firmware id with a single interface) makes them disagree: the small 'struct completion' stored by uea_probe() is then passed to usbatm_usb_disconnect(), which casts it to 'struct usbatm_data' and takes instance->serialize, reading past the end of the allocation: BUG: KASAN: slab-out-of-bounds in __mutex_lock+0x152a/0x1b80 Read of size 8 at addr ffff8880470e2c60 by task kworker/1:2/982 ... __mutex_lock+0x152a/0x1b80 usbatm_usb_disconnect+0x70/0x820 uea_disconnect+0x133/0x2c0 usb_unbind_interface+0x1dd/0x9e0 ... which belongs to the cache kmalloc-96 of size 96 The buggy address is located 0 bytes to the right of allocated 96-byte region [ffff8880470e2c00, ffff8880470e2c60) Reject such inconsistent descriptors in uea_probe() so that both handlers always make the same pre/post-firmware decision.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/0cc0c4c14150bb5a16b88dd61368f96cd4caa9ce
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/71132cedd1ecbc4032d76e9928c18a10f7e39b80
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9904a46401198872ab3de34fd11f383831ef3428
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9e7312844429379108ea9523a5ed934f142bb177
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c035b1198906dd5bd3df9a3045b59254bad1ea7a
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d0a57f19fe2865b9747484f5f9c631f944ed9a0f
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e814ae925f6f575325124c29dde518b92c822b83
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f92832262718443feb4e5df2bf70424ba842629e
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/atm/ueagle-atm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9e7312844429379108ea9523a5ed934f142bb177",
              "status": "affected",
              "version": "d85f19aaef42a03e3e4765d659c761c8750a7f23",
              "versionType": "git"
            },
            {
              "lessThan": "f92832262718443feb4e5df2bf70424ba842629e",
              "status": "affected",
              "version": "76861031b43a18065d13f9ffb8595d25c7576005",
              "versionType": "git"
            },
            {
              "lessThan": "e814ae925f6f575325124c29dde518b92c822b83",
              "status": "affected",
              "version": "bbfedc84714064ea4845e6b76f96316eb5bb65d8",
              "versionType": "git"
            },
            {
              "lessThan": "c035b1198906dd5bd3df9a3045b59254bad1ea7a",
              "status": "affected",
              "version": "f2a6abc670104fc3e383ee3b1cf35c070485e3df",
              "versionType": "git"
            },
            {
              "lessThan": "9904a46401198872ab3de34fd11f383831ef3428",
              "status": "affected",
              "version": "c581e30ae5b332d8acef64475a211b3f82099941",
              "versionType": "git"
            },
            {
              "lessThan": "d0a57f19fe2865b9747484f5f9c631f944ed9a0f",
              "status": "affected",
              "version": "509b51327320bdeaef1969248177a446ded073ab",
              "versionType": "git"
            },
            {
              "lessThan": "0cc0c4c14150bb5a16b88dd61368f96cd4caa9ce",
              "status": "affected",
              "version": "ddcdac47e1f2651c7be60e299f98faf981522797",
              "versionType": "git"
            },
            {
              "lessThan": "71132cedd1ecbc4032d76e9928c18a10f7e39b80",
              "status": "affected",
              "version": "e2674dfbed8a30d57e2bc872c4bfa6c3eec918bf",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/atm/ueagle-atm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5.10.265",
              "status": "affected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.216",
              "status": "affected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.183",
              "status": "affected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.148",
              "status": "affected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.101",
              "status": "affected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.42",
              "status": "affected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThan": "7.1.6",
              "status": "affected",
              "version": "7.1.5",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect\n\nuea_probe() distinguishes a pre-firmware device from a post-firmware one\nusing the USB id (UEA_IS_PREFIRM()), and stores a different object as the\ninterface data in each case: a \u0027struct completion\u0027 for a pre-firmware\ndevice (to be waited on in .disconnect()), or a \u0027struct usbatm_data\u0027 for a\npost-firmware one.\n\nuea_disconnect() instead tells the two apart by the number of interfaces\nof the active configuration (a pre-firmware device exposes a single\ninterface, ADI930 has 2 and eagle has 3), and casts the interface data\naccordingly.\n\nBecause the two handlers use different criteria, a crafted device that\nadvertises a pre-firmware id together with a multi-interface descriptor\n(or a post-firmware id with a single interface) makes them disagree: the\nsmall \u0027struct completion\u0027 stored by uea_probe() is then passed to\nusbatm_usb_disconnect(), which casts it to \u0027struct usbatm_data\u0027 and takes\ninstance-\u003eserialize, reading past the end of the allocation:\n\n  BUG: KASAN: slab-out-of-bounds in __mutex_lock+0x152a/0x1b80\n  Read of size 8 at addr ffff8880470e2c60 by task kworker/1:2/982\n  ...\n   __mutex_lock+0x152a/0x1b80\n   usbatm_usb_disconnect+0x70/0x820\n   uea_disconnect+0x133/0x2c0\n   usb_unbind_interface+0x1dd/0x9e0\n  ...\n  which belongs to the cache kmalloc-96 of size 96\n  The buggy address is located 0 bytes to the right of\n   allocated 96-byte region [ffff8880470e2c00, ffff8880470e2c60)\n\nReject such inconsistent descriptors in uea_probe() so that both handlers\nalways make the same pre/post-firmware decision."
    }
  ],
  "id": "CVE-2026-68344",
  "lastModified": "2026-08-19T17:20:44.223",
  "metrics": {},
  "published": "2026-08-10T13:20:24.947",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/0cc0c4c14150bb5a16b88dd61368f96cd4caa9ce"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/71132cedd1ecbc4032d76e9928c18a10f7e39b80"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/9904a46401198872ab3de34fd11f383831ef3428"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/9e7312844429379108ea9523a5ed934f142bb177"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/c035b1198906dd5bd3df9a3045b59254bad1ea7a"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d0a57f19fe2865b9747484f5f9c631f944ed9a0f"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/e814ae925f6f575325124c29dde518b92c822b83"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/f92832262718443feb4e5df2bf70424ba842629e"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.