CVE-2026-68344

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect

uea_probe() distinguishes a pre-firmware device from a post-firmware one

using the USB id (UEA_IS_PREFIRM()), and stores a different object as the

interface data in each case: a 'struct completion' for a pre-firmware

device (to be waited on in .disconnect()), or a 'struct usbatm_data' for a

post-firmware one.

uea_disconnect() instead tells the two apart by the number of interfaces

of the active configuration (a pre-firmware device exposes a single

interface, ADI930 has 2 and eagle has 3), and casts the interface data

accordingly.

Because the two handlers use different criteria, a crafted device that

advertises a pre-firmware id together with a multi-interface descriptor

(or a post-firmware id with a single interface) makes them disagree: the

small 'struct completion' stored by uea_probe() is then passed to

usbatm_usb_disconnect(), which cast

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References