CVE-2026-68344 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect
uea_probe() distinguishes a pre-firmware device from a post-firmware one using the USB id (UEA_IS_PREFIRM()), and stores a different object as the interface data in each case: a 'struct completion' for a pre-firmware device (to be waited on in .disconnect()), or a 'struct usbatm_data' for a post-firmware one.
uea_disconnect() instead tells the two apart by the number of interfaces of the active configuration (a pre-firmware device exposes a single interface, ADI930 has 2 and eagle has 3), and casts the interface data accordingly.
Because the two handlers use different criteria, a crafted device that advertises a pre-firmware id together with a multi-interface descriptor (or a post-firmware id with a single interface) makes them disagree: the small 'struct completion' stored by uea_probe() is then passed to usbatm_usb_disconnect(), which casts it to 'struct usbatm_data' and takes instance->serialize, reading past the end of the allocation:
BUG: KASAN: slab-out-of-bounds in __mutex_lock+0x152a/0x1b80 Read of size 8 at addr ffff8880470e2c60 by task kworker/1:2/982 ... __mutex_lock+0x152a/0x1b80 usbatm_usb_disconnect+0x70/0x820 uea_disconnect+0x133/0x2c0 usb_unbind_interface+0x1dd/0x9e0 ... which belongs to the cache kmalloc-96 of size 96 The buggy address is located 0 bytes to the right of allocated 96-byte region [ffff8880470e2c00, ffff8880470e2c60)
Reject such inconsistent descriptors in uea_probe() so that both handlers always make the same pre/post-firmware decision.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability exists in the linux kernel's usb atm subsystem specifically within the ueagle-atm driver implementation. The flaw stems from inconsistent device state detection between two critical functions: uea_probe() and uea_disconnect(). The probe function uses the USB vendor and product ID to determine whether a device is pre-firmware or post-firmware, storing different data structures accordingly. For pre-firmware devices, it stores a struct completion object meant for synchronization during the firmware loading process, while post-firmware devices get a struct usbatm_data object containing the actual device state information. However, the disconnect handler employs a different detection mechanism based on the number of interfaces exposed by the USB configuration rather than the device ID. This discrepancy creates a scenario where maliciously crafted USB devices can exploit this inconsistency to cause memory corruption.
The technical exploitation occurs through descriptor manipulation that confuses both detection mechanisms simultaneously. When a device advertises a pre-firmware USB ID but presents a multi-interface descriptor, or vice versa, the two functions make contradictory determinations about the device state. During disconnect processing, uea_disconnect() makes its decision based on interface count and then casts the stored data to the wrong type. Specifically, when a pre-firmware device with multi-interfaces is encountered, the struct completion object (96 bytes) gets cast to a struct usbatm_data pointer, causing subsequent memory access to read past the allocated boundary through the serialize member field. This results in a kernel memory access violation that manifests as a slab-out-of-bounds error in the kernel's memory management system.
The operational impact of this vulnerability extends beyond simple memory corruption to potentially enable privilege escalation and system instability. The kernel address sanitizer (KASAN) detection reveals that the attack targets a 96-byte kmalloc allocation, where a read operation attempts to access 8 bytes past the valid boundary at address ffff8880470e2c60. This type of out-of-bounds access could allow attackers to corrupt kernel data structures or potentially execute arbitrary code with kernel privileges. The vulnerability affects systems running linux kernels with usb atm support and specifically impacts the ueagle-atm driver implementation that handles devices from vendors like ADI and Eagle. According to CWE classification, this represents a CWE-125: Out-of-bounds Read vulnerability, while the ATT&CK framework would categorize this under T1068: Exploitation for Privilege Escalation and T1547.001: Registry Run Keys / Startup Folder techniques.
The mitigation strategy requires implementing consistent device state detection logic within the uea_probe() function to reject descriptor combinations that would cause disagreement between probe and disconnect handlers. This involves adding validation checks to ensure that USB device descriptors maintain consistent pre/post-firmware characteristics, preventing the storage of incorrect data types in the interface private data field. The fix must be implemented at the driver level where the initial device identification occurs, ensuring that all subsequent operations rely on consistent state information. Additionally, proper bounds checking and memory validation should be enforced during disconnect processing to prevent casting operations that could lead to memory corruption, making this a defensive programming approach that aligns with secure coding standards and kernel security hardening practices.