CVE-2026-68344

What the bug is

uea_probe() distinguishes a pre-firmware device from a post-firmware one using the USB id (UEA_IS_PREFIRM()), and stores a different object as the interface data in each case: a 'struct completion' for a pre-firmware device (to be waited on in .disconnect()), or a 'struct usbatm_data' for a post-firmware one. uea_disconnect() instead tells the two apart by the number of interfaces of the active configuration (a pre-firmware device exposes a single interface, ADI930 has 2 and eagle has 3), and casts the interface data accordingly. Because the two handlers use different criteria, a crafted device that advertises a pre-firmware id together with a multi-interface descriptor (or a post-firmware id with a single interface) makes them disagree: the small 'struct completion' stored by uea_probe() is then passed to usbatm_usb_disconnect(), which casts it to 'struct usbatm_data' and takes instance->serialize, reading past the end of the allocation: BUG: KASAN: slab-out-of-bounds in __mutex_lock+0x152a/0x1b80 Read of size 8 at addr ffff8880470e2c60 by task kworker/1:2/982 ... __mutex_lock+0x152a/0x1b80 usbatm_usb_disconnect+0x70/0x820 uea_disconnect+0x133/0x2c0 usb_unbind_interface+0x1dd/0x9e0 ... which belongs to the cache kmalloc-96 of size 96 The buggy address is located 0 bytes to the right of allocated 96-byte region [ffff8880470e2c00, ffff8880470e2c60) Reject such inconsistent descriptors in uea_probe() so that both handlers always make the same pre/post-firmware decision.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

drivers/usb/atm/ueagle-atm.c

What this is

IKANOS/ADI EAGLE ADSL USB DRIVERMAINTAINERS section matched on drivers/usb/atm/ueagle-atm.c · Maintained

Kernel module

none to look for. The file would have gone into ueagle_atm, and Debian does not compile it into that module, so finding ueagle_atm in lsmod would say nothing about this CVE.

Check it on the machine

grep -wE 'CONFIG_OF|CONFIG_PCI|CONFIG_USB|CONFIG_USB_ATM|CONFIG_USB_GADGET|CONFIG_USB_PHY|CONFIG_USB_SPEEDTOUCH|CONFIG_USB_SUPPORT|CONFIG_USB_UEAGLEATM' /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

Show whether Debian builds this, per release

Debian does not build this code. In 5 releases below, every kernel flavour Debian publishes has the switch off, so the vulnerable file is compiled into no kernel binary Debian ships.

• bookworm, trixie, forky, sid, bookworm · linux-6.12n

n

not enabled on any flavour - this release does not build the code

Build switches

CONFIG_OF, CONFIG_PCI, CONFIG_USB, CONFIG_USB_ATM, CONFIG_USB_GADGET, CONFIG_USB_PHY, CONFIG_USB_SPEEDTOUCH, CONFIG_USB_SUPPORT, CONFIG_USB_UEAGLEATM

Reads as

all on means the file is compiled; any one off means it is not.

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Signals

Published

2026-08-10 (2 months ago)source

CVSS

no vector published, unrated

Attack vector

not published

EPSS

0.22%, higher than 11.3% of all CVEssource

CISA KEV

not listedthe KEV catalogue

Debian urgency

not yet assignedsource

Subsystem

drivers/usb

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
5.10.261	5.10.265	9e7312844429
5.15.212	5.15.216	f92832262718
6.1.178	6.1.183	e814ae925f6f
6.6.145	6.6.148	c035b1198906
6.12.97	6.12.101	9904a4640119
6.18.40	6.18.42	d0a57f19fe28
7.1.5	7.1.6	0cc0c4c14150
7.2	7.2	71132cedd1ec

Debian advisories