Cloudanix VulnDB

CVE-2026-68344

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A USB modem driver in the Linux kernel could misinterpret device information and read memory it should not, potentially causing the system to crash when the device is plugged in or removed.

Exploitation
Physical Access
Attacker needs
Physical Access
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Type confusion between a 96-byte struct completion and a larger struct usbatm_data in ueagle-atm USB driver, resulting in out-of-bounds read during mutex acquisition on disconnect.

Why it matters to the business

Kernel memory corruption on systems using the ueagle-atm driver with certain USB modems can cause crashes, denial of service, or potential privilege escalation; low exploitability reduces immediate risk but still requires patching for stability.

How an attack unfolds

An attacker presents a crafted USB device whose descriptors cause uea_probe() and uea_disconnect() to disagree on pre- versus post-firmware state; the smaller completion object is then cast and dereferenced as usbatm_data, reading past its allocation.

How to fix it

Apply the upstream kernel patch that rejects inconsistent descriptors in uea_probe(); rebuild and reboot with the fixed ueagle-atm module; ensure the driver is disabled if the hardware is not required.

How to confirm the fix worked

Confirm the patch is present by checking for the new descriptor validation logic in uea_probe(); test with a device simulator or the original reproducer to verify no KASAN report occurs on connect/disconnect.

Typical attack path

  1. Attacker connects a USB device advertising inconsistent pre-firmware ID and multi-interface descriptors
  2. uea_probe() stores a struct completion based on USB ID
  3. uea_disconnect() selects usbatm_usb_disconnect path based on interface count
  4. Incorrect cast triggers out-of-bounds read inside mutex lock

How to detect it

Look in kernel logs for KASAN slab-out-of-bounds reports referencing usbatm_usb_disconnect or uea_disconnect; inspect dmesg or journalctl for ueagle-atm probe/disconnect sequences around crash times.

What your security team should do

  • Prioritize kernel update on any host exposing ueagle-atm USB devices
  • Audit systems for presence of the ueagle-atm module and disable via modprobe blacklist if unused
  • Monitor for future Linux kernel updates containing this fix

The record

In the Linux kernel, the following vulnerability has been resolved: usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect uea_probe() distinguishes a pre-firmware device from a post-firmware one using the USB id (UEA_IS_PREFIRM()), and stores a different object as the interface data in each case: a 'struct completion' for a pre-firmware device (to be waited on in .disconnect()), or a 'struct usbatm_data' for a post-firmware one. uea_disconnect() instead tells the two apart by the number of interfaces of the active configuration (a pre-firmware device exposes a single interface, ADI930 has 2 and eagle has 3), and casts the interface data accordingly. Because the two handlers use different criteria, a crafted device that advertises a pre-firmware id together with a multi-interface descriptor (or a post-firmware id with a single interface) makes them disagree: the small 'struct completion' stored by uea_probe() is then passed to usbatm_usb_disconnect(), which casts it to 'struct usbatm_data' and takes instance->serialize, reading past the end of the allocation: BUG: KASAN: slab-out-of-bounds in __mutex_lock+0x152a/0x1b80 Read of size 8 at addr ffff8880470e2c60 by task kworker/1:2/982 ... __mutex_lock+0x152a/0x1b80 usbatm_usb_disconnect+0x70/0x820 uea_disconnect+0x133/0x2c0 usb_unbind_interface+0x1dd/0x9e0 ... which belongs to the cache kmalloc-96 of size 96 The buggy address is located 0 bytes to the right of allocated 96-byte region [ffff8880470e2c00, ffff8880470e2c60) Reject such inconsistent descriptors in uea_probe() so that both handlers always make the same pre/post-firmware decision.

Affected packages

Ecosystem Package Introduced Fixed