CVE-2026-68456

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()

ueagle-atm uses the asynchronous request_firmware_nowait() in .probe(),

but does not wait for its completion, not even in .disconnect(); so, if the

device is unplugged meanwhile, its teardown runs concurrently with that.

Even though this inconsistency is worth addressing on its own, it has also

triggered several bug reports in syzbot over the years (some auto-closed)

where the firmware sysfs fallback mechanism (CONFIG_FW_LOADER_USER_HELPER)

creates a firmware subdirectory in the device directory during its removal,

which might hit unexpected conditions in kernfs, apparently, depending at

which point the add and remove operations raced. (See links.)

The pattern is:

usb ?-?: Direct firmware load for ueagle-atm/eagle?.fw failed with error -2

usb ?-?: Falling back to sysfs fallback for: ueagle-atm/eagle?.fw

<ERROR>

Call trace:

...

kernfs_create_dir_ns

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References