# CVE-2026-68344: usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect Status: published. Published: 2026-08-10. Updated: 2026-11-06. In the Linux kernel, the following vulnerability has been resolved: usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect uea_probe() distinguishes a pre-firmware device from a post-firmware one using the USB id (UEA_IS_PREFIRM()), and stores a different object as the interface data in each case: a 'struct completion' for a pre-firmware device (to be waited on in .disconnect()), or a 'struct usbatm_data' for a post-firmware one. uea_disconnect() instead tells the two apart by the number of interfaces of the active configuration (a pre-firmware device exposes a single interface, ADI930 has 2 and eagle has 3), and casts the interface data accordingly. Because the two handlers use different criteria, a crafted device that advertises a pre-firmware id together with a multi-interface descriptor (or a post-firmware id with a single interface) makes them disagree: the small 'struct completion' stored by uea_probe() is then passed to usbatm_usb_disconnect(), which casts it to 'struct usbatm_data' and takes instance->serialize, reading past the end of the allocation: BUG: KASAN: slab-out-of-bounds in __mutex_lock+0x152a/0x1b80 Read of size 8 at addr ffff8880470e2c60 by task kworker/1:2/982 ... __mutex_lock+0x152a/0x1b80 usbatm_usb_disconnect+0x70/0x820 uea_disconnect+0x133/0x2c0 usb_unbind_interface+0x1dd/0x9e0 ... which belongs to the cache kmalloc-96 of size 96 The buggy address is located 0 bytes to the right of allocated 96-byte region [ffff8880470e2c00, ffff8880470e2c60) Reject such inconsistent descriptors in uea_probe() so that both handlers always make the same pre/post-firmware decision. ## Remediation No remediation reported in collected sources ## Affected products and versions - Linux / Linux: ≥ d85f19aaef42a03e3e4765d659c761c8750a7f23; < 9e7312844429379108ea9523a5ed934f142bb177 (affected, git); ≥ 76861031b43a18065d13f9ffb8595d25c7576005; < f92832262718443feb4e5df2bf70424ba842629e (affected, git); ≥ bbfedc84714064ea4845e6b76f96316eb5bb65d8; < e814ae925f6f575325124c29dde518b92c822b83 (affected, git); ≥ f2a6abc670104fc3e383ee3b1cf35c070485e3df; < c035b1198906dd5bd3df9a3045b59254bad1ea7a (affected, git); ≥ c581e30ae5b332d8acef64475a211b3f82099941; < 9904a46401198872ab3de34fd11f383831ef3428 (affected, git); ≥ 509b51327320bdeaef1969248177a446ded073ab; < d0a57f19fe2865b9747484f5f9c631f944ed9a0f (affected, git); ≥ ddcdac47e1f2651c7be60e299f98faf981522797; < 0cc0c4c14150bb5a16b88dd61368f96cd4caa9ce (affected, git); ≥ e2674dfbed8a30d57e2bc872c4bfa6c3eec918bf; < 71132cedd1ecbc4032d76e9928c18a10f7e39b80 (affected, git). Source: CNA: Linux - Linux / Linux: ≥ 5.10.261; < 5.10.265 (affected, semver); ≥ 5.15.212; < 5.15.216 (affected, semver); ≥ 6.1.178; < 6.1.183 (affected, semver); ≥ 6.6.145; < 6.6.148 (affected, semver); ≥ 6.12.97; < 6.12.101 (affected, semver); ≥ 6.18.40; < 6.18.42 (affected, semver); ≥ 7.1.5; < 7.1.6 (affected, semver). Source: CNA: Linux ## Severity and prioritization - CISA KEV: No listing in collected sources - EPSS: 0.22% as of 2026-11-06; percentile 12.13% - SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP - Weaknesses: Not reported ## Exploit evidence No exploit evidence in collected sources. This is not proof of no exploitation. ## References - https://git.kernel.org/stable/c/9e7312844429379108ea9523a5ed934f142bb177 (CNA: Linux) - https://git.kernel.org/stable/c/f92832262718443feb4e5df2bf70424ba842629e (CNA: Linux) - https://git.kernel.org/stable/c/e814ae925f6f575325124c29dde518b92c822b83 (CNA: Linux) - https://git.kernel.org/stable/c/c035b1198906dd5bd3df9a3045b59254bad1ea7a (CNA: Linux) - https://git.kernel.org/stable/c/9904a46401198872ab3de34fd11f383831ef3428 (CNA: Linux) - https://git.kernel.org/stable/c/d0a57f19fe2865b9747484f5f9c631f944ed9a0f (CNA: Linux) - https://git.kernel.org/stable/c/0cc0c4c14150bb5a16b88dd61368f96cd4caa9ce (CNA: Linux) - https://git.kernel.org/stable/c/71132cedd1ecbc4032d76e9928c18a10f7e39b80 (CNA: Linux) - https://git.kernel.org/stable/c/0cc0c4c14150bb5a16b88dd61368f96cd4caa9ce (416baaa9-dc9f-4396-8d5f-8c081fb06d67) - https://git.kernel.org/stable/c/71132cedd1ecbc4032d76e9928c18a10f7e39b80 (416baaa9-dc9f-4396-8d5f-8c081fb06d67) - https://git.kernel.org/stable/c/9904a46401198872ab3de34fd11f383831ef3428 (416baaa9-dc9f-4396-8d5f-8c081fb06d67) - https://git.kernel.org/stable/c/9e7312844429379108ea9523a5ed934f142bb177 (416baaa9-dc9f-4396-8d5f-8c081fb06d67) - https://git.kernel.org/stable/c/c035b1198906dd5bd3df9a3045b59254bad1ea7a (416baaa9-dc9f-4396-8d5f-8c081fb06d67) - https://git.kernel.org/stable/c/d0a57f19fe2865b9747484f5f9c631f944ed9a0f (416baaa9-dc9f-4396-8d5f-8c081fb06d67) - https://git.kernel.org/stable/c/e814ae925f6f575325124c29dde518b92c822b83 (416baaa9-dc9f-4396-8d5f-8c081fb06d67) - https://git.kernel.org/stable/c/f92832262718443feb4e5df2bf70424ba842629e (416baaa9-dc9f-4396-8d5f-8c081fb06d67) ## Provenance - CNA: Linux: https://www.cve.org/CVERecord?id=CVE-2026-68344; retrieved 2026-11-06; source updated 2026-11-06 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-68344; retrieved 2026-11-06; source updated 2026-11-06 - FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-68344; retrieved 2026-11-06; source updated Not reported Revision: 6334792d0f0ba064a604a857b274898fee2b0a5124929e555d2a1215874231a5 Canonical: https://y2.dev/cve/CVE-2026-68344 ## Agent and API access Public CVE pages, Markdown, and JSON are free to read without an account or API key. - Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end. - WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers. - Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}. - Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer . Setup: https://y2.dev/docs/api/create-key. - x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402. - OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json. Collected public records only. Check source status for coverage and freshness.