Answer in brief
CVE-2026-68344 records a Unknown severity vulnerability in usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=f2a6abc670104fc3e383ee3b1cf35c070485e3df <c035b1198906dd5bd3df9a3045b59254bad1ea7a || >=c581e30ae5b332d8acef64475a211b3f82099941 <9904a46401198872ab3de34fd11f383831ef3428 || >=509b51327320bdeaef1969248177a446ded073ab <d0a57f19fe2865b9747484f5f9c631f944ed9a0f || >=ddcdac47e1f2651c7be60e299f98faf981522797 <0cc0c4c14150bb5a16b88dd61368f96cd4caa9ce || >=e2674dfbed8a30d57e2bc872c4bfa6c3eec918bf <71132cedd1ecbc4032d76e9928c18a10f7e39b80 || d85f19aaef42a03e3e4765d659c761c8750a7f23 || 76861031b43a18065d13f9ffb8595d25c7576005 || bbfedc84714064ea4845e6b76f96316eb5bb65d8 || >=6.6.145 <6.6.148 || >=6.12.97 <6.12.101 || >=6.18.40 <6.18.42 || >=7.1.5 <7.1.6 || >=5.10.261 <5.11 || >=5.15.212 <5.16 || >=6.1.178 <6.2 | c035b1198906dd5bd3df9a3045b59254bad1ea7a, 9904a46401198872ab3de34fd11f383831ef3428, d0a57f19fe2865b9747484f5f9c631f944ed9a0f, 0cc0c4c14150bb5a16b88dd61368f96cd4caa9ce, 71132cedd1ecbc4032d76e9928c18a10f7e39b80, 6.6.148, 6.12.101, 6.18.42, 7.1.6, 5.11, 5.16, 6.2 |
| Linux/Linuxgeneric | 7.2-rc3 | Not reported |
Published upstream
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 10, 2026
In the Linux kernel, the following vulnerability has been resolved: usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect uea_probe() distinguishes a pre-firmware device from a post-firmware one using the USB id (UEA_IS_PREFIRM()), and stores a different object as the interface data in each case: a 'struct completion' for a pre-firmware device (to be waited on in .disconnect()), or a 'struct usbatm_data' for a post-firmware one. uea_disconnect() instead tells the two apart by the number of interfaces of the active configuration (a pre-firmware device exposes a single interface, ADI930 has 2 and eagle has 3), and casts the interface data accordingly. Because the two handlers use different criteria, a crafted device that advertises a pre-firmware id together with a multi-interface descriptor (or a post-firmware id with a single interface) makes them disagree: the small 'struct completion' stored by uea_probe() is then passed to usbatm_usb_disconnect(), which casts it to 'struct usbatm_data' and takes instance->serialize, reading past the end of the allocation: BUG: KASAN: slab-out-of-bounds in __mutex_lock+0x152a/0x1b80 Read of size 8 at addr ffff8880470e2c60 by task kworker/1:2/982 ... __mutex_lock+0x152a/0x1b80 usbatm_usb_disconnect+0x70/0x820 uea_disconnect+0x133/0x2c0 usb_unbind_interface+0x1dd/0x9e0 ... which belongs to the cache kmalloc-96 of size 96 The buggy address is located 0 bytes to the right of allocated 96-byte region [ffff8880470e2c00, ffff8880470e2c60) Reject such inconsistent descriptors in uea_probe() so that both handlers always make the same pre/post-firmware decision.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-68344 records a Unknown severity vulnerability in usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=f2a6abc670104fc3e383ee3b1cf35c070485e3df <c035b1198906dd5bd3df9a3045b59254bad1ea7a || >=c581e30ae5b332d8acef64475a211b3f82099941 <9904a46401198872ab3de34fd11f383831ef3428 || >=509b51327320bdeaef1969248177a446ded073ab <d0a57f19fe2865b9747484f5f9c631f944ed9a0f || >=ddcdac47e1f2651c7be60e299f98faf981522797 <0cc0c4c14150bb5a16b88dd61368f96cd4caa9ce || >=e2674dfbed8a30d57e2bc872c4bfa6c3eec918bf <71132cedd1ecbc4032d76e9928c18a10f7e39b80 || d85f19aaef42a03e3e4765d659c761c8750a7f23 || 76861031b43a18065d13f9ffb8595d25c7576005 || bbfedc84714064ea4845e6b76f96316eb5bb65d8 || >=6.6.145 <6.6.148 || >=6.12.97 <6.12.101 || >=6.18.40 <6.18.42 || >=7.1.5 <7.1.6 || >=5.10.261 <5.11 || >=5.15.212 <5.16 || >=6.1.178 <6.2 | c035b1198906dd5bd3df9a3045b59254bad1ea7a, 9904a46401198872ab3de34fd11f383831ef3428, d0a57f19fe2865b9747484f5f9c631f944ed9a0f, 0cc0c4c14150bb5a16b88dd61368f96cd4caa9ce, 71132cedd1ecbc4032d76e9928c18a10f7e39b80, 6.6.148, 6.12.101, 6.18.42, 7.1.6, 5.11, 5.16, 6.2 |
| Linux/Linuxgeneric | 7.2-rc3 | Not reported |
Published upstream
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 10, 2026
In the Linux kernel, the following vulnerability has been resolved: usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect uea_probe() distinguishes a pre-firmware device from a post-firmware one using the USB id (UEA_IS_PREFIRM()), and stores a different object as the interface data in each case: a 'struct completion' for a pre-firmware device (to be waited on in .disconnect()), or a 'struct usbatm_data' for a post-firmware one. uea_disconnect() instead tells the two apart by the number of interfaces of the active configuration (a pre-firmware device exposes a single interface, ADI930 has 2 and eagle has 3), and casts the interface data accordingly. Because the two handlers use different criteria, a crafted device that advertises a pre-firmware id together with a multi-interface descriptor (or a post-firmware id with a single interface) makes them disagree: the small 'struct completion' stored by uea_probe() is then passed to usbatm_usb_disconnect(), which casts it to 'struct usbatm_data' and takes instance->serialize, reading past the end of the allocation: BUG: KASAN: slab-out-of-bounds in __mutex_lock+0x152a/0x1b80 Read of size 8 at addr ffff8880470e2c60 by task kworker/1:2/982 ... __mutex_lock+0x152a/0x1b80 usbatm_usb_disconnect+0x70/0x820 uea_disconnect+0x133/0x2c0 usb_unbind_interface+0x1dd/0x9e0 ... which belongs to the cache kmalloc-96 of size 96 The buggy address is located 0 bytes to the right of allocated 96-byte region [ffff8880470e2c00, ffff8880470e2c60) Reject such inconsistent descriptors in uea_probe() so that both handlers always make the same pre/post-firmware decision.
Quoted source text, attributed separately from HOL analysis.