CVE-2026-68344: usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect

uea_probe() distinguishes a pre-firmware device from a post-firmware one
using the USB id (UEA_IS_PREFIRM()), and stores a different object as the
interface data in each case: a 'struct completion' for a pre-firmware
device (to be waited on in .disconnect()), or a 'struct usbatm_data' for a
post-firmware one.

uea_disconnect() instead tells the two apart by the number of interfaces
of the active configuration (a pre-firmware device exposes a single
interface, ADI930 has 2 and eagle has 3), and casts the interface data
accordingly.

Because the two handlers use different criteria, a crafted device that
advertises a pre-firmware id together with a multi-interface descriptor
(or a post-firmware id with a single interface) makes them disagree: the
small 'struct completion' stored by uea_probe() is then passed to
usbatm_usb_disconnect(), which casts it to 'struct usbatm_data' and takes
instance->serialize, reading past the end of the allocation:

  BUG: KASAN: slab-out-of-bounds in __mutex_lock+0x152a/0x1b80
  Read of size 8 at addr ffff8880470e2c60 by task kworker/1:2/982
  ...
   __mutex_lock+0x152a/0x1b80
   usbatm_usb_disconnect+0x70/0x820
   uea_disconnect+0x133/0x2c0
   usb_unbind_interface+0x1dd/0x9e0
  ...
  which belongs to the cache kmalloc-96 of size 96
  The buggy address is located 0 bytes to the right of
   allocated 96-byte region [ffff8880470e2c00, ffff8880470e2c60)

Reject such inconsistent descriptors in uea_probe() so that both handlers
always make the same pre/post-firmware decision.

The Linux kernel CVE team has assigned CVE-2026-68344 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.6.145 with commit f2a6abc670104fc3e383ee3b1cf35c070485e3df and fixed in 6.6.148 with commit c035b1198906dd5bd3df9a3045b59254bad1ea7a
	Issue introduced in 6.12.97 with commit c581e30ae5b332d8acef64475a211b3f82099941 and fixed in 6.12.101 with commit 9904a46401198872ab3de34fd11f383831ef3428
	Issue introduced in 6.18.40 with commit 509b51327320bdeaef1969248177a446ded073ab and fixed in 6.18.42 with commit d0a57f19fe2865b9747484f5f9c631f944ed9a0f
	Issue introduced in 7.1.5 with commit ddcdac47e1f2651c7be60e299f98faf981522797 and fixed in 7.1.6 with commit 0cc0c4c14150bb5a16b88dd61368f96cd4caa9ce
	Issue introduced in 7.2-rc3 with commit e2674dfbed8a30d57e2bc872c4bfa6c3eec918bf and fixed in 7.2-rc5 with commit 71132cedd1ecbc4032d76e9928c18a10f7e39b80
	Issue introduced in 5.10.261 with commit d85f19aaef42a03e3e4765d659c761c8750a7f23
	Issue introduced in 5.15.212 with commit 76861031b43a18065d13f9ffb8595d25c7576005
	Issue introduced in 6.1.178 with commit bbfedc84714064ea4845e6b76f96316eb5bb65d8

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68344
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/usb/atm/ueagle-atm.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/c035b1198906dd5bd3df9a3045b59254bad1ea7a
	https://git.kernel.org/stable/c/9904a46401198872ab3de34fd11f383831ef3428
	https://git.kernel.org/stable/c/d0a57f19fe2865b9747484f5f9c631f944ed9a0f
	https://git.kernel.org/stable/c/0cc0c4c14150bb5a16b88dd61368f96cd4caa9ce
	https://git.kernel.org/stable/c/71132cedd1ecbc4032d76e9928c18a10f7e39b80