CVE-2026-68344

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ueagle-atm driver where the uea probe() and uea disconnect() functions use inconsistent criteria to distinguish between pre-firmware and post-firmware devices. While uea probe() relies on the USB ID via UEA IS PREFIRM(), uea disconnect() determines the device state based on the number of interfaces in the active configuration. A crafted device providing a pre-firmware ID with a multi-interface descriptor, or a post-firmware ID with a single interface, can cause a mismatch. This leads to a struct completion object being incorrectly cast to a struct usbatm data object in usbatm usb disconnect(), resulting in a slab-out-of-bounds read when accessing the serialize variable.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.