CVE-2026-68327 Overview
CVE-2026-68327 is a NULL pointer dereference vulnerability in the Linux kernel's wanxl WAN driver. The flaw resides in wanxl_pci_init_one(), which stores the freshly allocated card structure in driver data before mapping the PLX Base Address Register (BAR). If an early probe failure occurs, the cleanup path wanxl_pci_remove_one() unconditionally calls wanxl_reset(), which dereferences card->plx. Because card->plx remains NULL at that point, the kernel dereferences a NULL Memory-Mapped I/O (MMIO) pointer. A static analysis checker identified the issue and manual source review confirmed it. The upstream fix defers the hardware reset until after the BAR mapping succeeds.
Critical Impact
Triggering the vulnerable probe error path causes a NULL MMIO dereference in kernel context, resulting in a kernel oops and denial of service on affected systems.
Affected Products
- Linux kernel branches containing the wanxl PCI WAN driver prior to the referenced stable commits
- Systems loading the wanxl driver against PLX-based synchronous serial hardware
- Distributions shipping kernels that have not backported the fixing commits
Discovery Timeline
- 2026-08-10 - CVE-2026-68327 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-68327
Vulnerability Analysis
The wanxl driver supports SBE wanXL PCI synchronous serial adapters, which use a PLX PCI9060 bridge chip. During probe, wanxl_pci_init_one() allocates a card structure and immediately publishes it via pci_set_drvdata(). Subsequent steps map the PLX BAR into card->plx, allocate the coherent DMA status area, and configure DMA masks. Any failure in these steps triggers cleanup through wanxl_pci_remove_one().
The cleanup helper calls wanxl_reset() without validating that MMIO resources exist. wanxl_reset() performs register writes through card->plx, which is still NULL when the failure occurred before BAR mapping. The kernel then dereferences a NULL pointer in supervisor mode and generates an oops, terminating the probe thread and destabilizing driver state.
Root Cause
The root cause is an ordering defect in error handling. The driver publishes partially initialized state and invokes a hardware reset routine that assumes fully mapped MMIO. This is a classic uninitialized resource dereference in a device teardown path.
Attack Vector
Exploitation requires triggering the early probe failure conditions, such as failed coherent DMA allocation or a rejected DMA mask restoration. Reaching this path typically requires local privileges to load the driver, physical access to install matching hardware, or a constrained memory environment that forces allocation failures. The observable impact is a kernel crash rather than privilege escalation or code execution.
The vulnerability manifests in the wanxl_pci_init_one() and wanxl_pci_remove_one() interaction. Refer to the Linux Kernel Commit 2fe22d58 and the Linux Kernel Commit 91957b89 for the corrected sequencing.
Detection Methods for CVE-2026-68327
Indicators of Compromise
- Kernel oops entries in dmesg referencing wanxl_reset or wanxl_pci_remove_one in the call trace
- NULL pointer dereference faults with a faulting address near zero occurring during PCI probe of wanxl devices
- Repeated wanxl module load failures accompanied by kernel taint flags
Detection Strategies
- Inventory running kernels and confirm whether the wanxl driver is present and loadable in your builds
- Compare installed kernel versions against the fixing commits listed in the vendor references to identify unpatched hosts
- Monitor kernel crash reporters and journald for oops signatures involving the wanxl symbol namespace
Monitoring Recommendations
- Forward kern.crit and kern.err log facilities to a centralized log platform for correlation
- Alert on unexpected kernel taint transitions and module load failures on systems with WAN adapters
- Track PCI probe failure rates on hosts where the wanxl driver is enabled to surface recurring cleanup crashes
How to Mitigate CVE-2026-68327
Immediate Actions Required
- Apply the upstream stable kernel updates that include the referenced commits and reboot affected systems
- Blacklist the wanxl module on hosts that do not use SBE wanXL hardware to remove the attack surface entirely
- Restrict physical and administrative access to systems that load third-party WAN adapters until patched
Patch Information
The fix reorders driver initialization so the hardware reset only runs after the PLX BAR is mapped. The remaining teardown steps in wanxl_pci_remove_one() already gate on resource acquisition. The patch is available across multiple stable branches. See the Linux Kernel Commit 59cbe6cf, the Linux Kernel Commit b9e2ff70, and the Linux Kernel Commit f4834132 for backport references.
Workarounds
- Prevent module autoload by adding blacklist wanxl to /etc/modprobe.d/ configuration on hosts without wanXL hardware
- Unload the wanxl module with modprobe -r wanxl if it is loaded and unused
- Limit kernel module loading to signed, vendor-supplied modules using kernel.modules_disabled or lockdown mode where feasible
# Configuration example
echo 'blacklist wanxl' | sudo tee /etc/modprobe.d/disable-wanxl.conf
sudo depmod -a
sudo modprobe -r wanxl 2>/dev/null || true
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
