CVE-2026-68344: Linux Kernel Use-After-Free Vulnerability

CVE-2026-68344 Overview

CVE-2026-68344 is a Linux kernel vulnerability in the usb/atm/ueagle-atm driver. The flaw stems from inconsistent logic between uea_probe() and uea_disconnect() when identifying pre-firmware versus post-firmware USB DSL modem devices. A crafted USB device that advertises a pre-firmware USB id together with a multi-interface descriptor (or the inverse) causes the two handlers to disagree, leading to a type confusion and an out-of-bounds read past a kmalloc-96 slab allocation. KASAN detects the read in __mutex_lock reached through usbatm_usb_disconnect(). The upstream fix rejects such inconsistent descriptors at probe time.

Critical Impact
A malicious or malformed USB device can trigger a slab out-of-bounds read in kernel context, enabling denial of service or potential information disclosure from adjacent kernel heap memory.

Affected Products

Linux kernel — drivers/usb/atm/ueagle-atm.c (USB ATM DSL modem driver)
Stable branches referenced by the upstream fix commits 0cc0c4c14150, 71132cedd1ec, 9904a4640119, c035b1198906, and d0a57f19fe28
Systems with the ueagle-atm module built or auto-loaded on USB device attach

Discovery Timeline

2026-08-10 - CVE-2026-68344 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68344

Vulnerability Analysis

The ueagle-atm driver supports Eagle USB DSL modems that operate in two firmware states. uea_probe() uses the UEA_IS_PREFIRM() macro against the USB id to decide which object to attach as interface private data: a struct completion for pre-firmware devices, or a struct usbatm_data for post-firmware devices. The .disconnect handler, uea_disconnect(), does not consult the USB id. Instead it counts interfaces on the active configuration, treating a single-interface device as pre-firmware and multi-interface devices (ADI930 with 2 interfaces, eagle with 3) as post-firmware.

Because the two paths use different criteria, a USB descriptor that mixes a pre-firmware id with more than one interface causes the handlers to disagree. On disconnect, the driver reinterprets the small struct completion as a much larger struct usbatm_data and dereferences instance->serialize. That access reads beyond the 96-byte kmalloc region, as reported by KASAN in __mutex_lock+0x152a/0x1b80 invoked from usbatm_usb_disconnect().

Root Cause

The root cause is a mismatch between two independent classification checks that must agree for driver state to remain type-safe. The vulnerability is a type confusion resulting in an out-of-bounds slab read (Out-of-Bounds Read, kernel driver flaw).

Attack Vector

Exploitation requires attaching a crafted or emulated USB device that advertises a ueagle-atm pre-firmware vendor/product id together with a multi-interface configuration descriptor, or a post-firmware id with a single interface. The malicious descriptor can be delivered by physical USB attachment or by a programmable device such as a Facedancer or BadUSB-style board. No authentication is required beyond local USB access. The impact is kernel memory disclosure and potential denial of service through kernel panic depending on adjacent slab contents.

No public proof-of-concept code is referenced in the advisory. See the upstream commits linked under Kernel Git Change Log for the exact descriptor validation added to uea_probe().

Detection Methods for CVE-2026-68344

Indicators of Compromise

KASAN reports of slab-out-of-bounds reads in __mutex_lock invoked from usbatm_usb_disconnect+0x70/0x820 and uea_disconnect
Kernel oops or panic messages referencing the kmalloc-96 cache during USB device disconnect events
Unexpected binding of the ueagle-atm driver to USB devices whose interface count does not match the expected pre-firmware or post-firmware topology

Detection Strategies

Monitor dmesg and journalctl -k for BUG: KASAN entries containing usbatm_usb_disconnect or uea_disconnect stack frames
Audit USB device enumeration logs (udevadm monitor, usbmon) for devices matching ueagle-atm VID/PID pairs but with anomalous interface descriptors
Correlate kernel crash telemetry with USB attach events on endpoints where the ueagle-atm module is present

Monitoring Recommendations

Forward kernel logs to a centralized data lake and alert on KASAN, oops, or GPF traces referencing USB ATM drivers
Track loaded kernel modules across the fleet and flag hosts where ueagle-atm is present but the hardware is not expected
Enable USB device authorization policies (/sys/bus/usb/devices/*/authorized) and log denied attachments for review

How to Mitigate CVE-2026-68344

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 0cc0c4c14150, 71132cedd1ec, 9904a4640119, c035b1198906, and d0a57f19fe28 from your distribution vendor
Blacklist the ueagle-atm module on systems that do not use Eagle USB DSL modems
Restrict physical USB access on servers, kiosks, and shared workstations where untrusted devices could be attached

Patch Information

The fix modifies uea_probe() to reject USB descriptors where the pre-firmware/post-firmware classification derived from the USB id disagrees with the interface count. This ensures uea_probe() and uea_disconnect() always reach the same decision and prevents the type confusion. See the Kernel Git Change Log for the primary commit and additional stable backports at 71132cedd1ec, 9904a4640119, c035b1198906, and d0a57f19fe28.

Workarounds

Add blacklist ueagle-atm to /etc/modprobe.d/ on hosts that do not need Eagle DSL modem support
Use USBGuard or equivalent policy engines to enforce an allowlist of trusted USB vendor/product ids
Disable unused USB ports in BIOS/UEFI on fixed-function systems where removable media is not required

bash

# Prevent the vulnerable driver from auto-loading
echo 'blacklist ueagle-atm' | sudo tee /etc/modprobe.d/blacklist-ueagle-atm.conf
sudo modprobe -r ueagle-atm 2>/dev/null || true
sudo update-initramfs -u