Cloudanix VulnDB

CVE-2026-68327

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel bug can crash the whole system when certain network cards fail to start up properly.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
High
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Null pointer dereference occurs in wanxl_pci_remove_one error unwind when wanxl_reset is invoked before PLX BAR mapping, leaving card->plx NULL.

Why it matters to the business

Kernel crash or panic possible during driver probe on affected WAN adapters when early resource allocation fails, leading to system instability and potential downtime.

How an attack unfolds

Conditions causing early probe failure (such as coherent memory allocation error) trigger the remove path which unconditionally resets hardware before the MMIO pointer is valid, dereferencing NULL.

How to fix it

Apply the upstream kernel fix that guards the hardware reset behind successful BAR mapping and ensures later resources are checked before cleanup.

How to confirm the fix worked

Confirm the corrected source order in wanxl_pci_init_one/wanxl_pci_remove_one; reproduce probe-failure paths and verify no NULL dereference oops occurs.

Typical attack path

  1. Load wanxl PCI driver on hardware that will fail early probe steps
  2. Trigger allocation or DMA mask failure inside wanxl_pci_init_one
  3. Error path invokes wanxl_pci_remove_one which calls wanxl_reset on unmapped card->plx

How to detect it

Inspect kernel ring buffer and dmesg for NULL pointer dereference oops mentioning wanxl_reset or wanxl_pci_remove_one during PCI probe; correlate with wanxl device presence.

What your security team should do

  • Prioritize kernel update on systems using wanxl WAN adapters
  • Monitor kernel logs for wanxl oops during device enumeration
  • Test driver load/unload under resource-constrained conditions after patching

The record

In the Linux kernel, the following vulnerability has been resolved: wan: wanxl: Only reset hardware after BAR mapping wanxl_pci_init_one() stores the freshly allocated card in driver data before the PLX BAR is mapped. Several early probe failures then unwind through wanxl_pci_remove_one(), including failure to allocate the coherent status area or to restore the DMA mask. wanxl_pci_remove_one() unconditionally calls wanxl_reset(), and wanxl_reset() dereferences card->plx. On those early failures card->plx is still NULL, so the error path can dereference a NULL MMIO pointer. Only issue the hardware reset once the BAR mapping exists. The remaining cleanup in wanxl_pci_remove_one() already checks whether later resources were allocated. This issue was found by a static analysis checker and confirmed by manual source review.

Affected packages

Ecosystem Package Introduced Fixed