CVE-2026-68344

A flaw was found in the Linux kernel's USB ATM (Asynchronous Transfer Mode) driver, specifically in the ueagle-atm module. A local attacker with physical access to a crafted USB device could exploit this vulnerability. By presenting inconsistent USB descriptors that confuse the driver's probe and disconnect functions, the attacker can trigger an out-of-bounds read. This can lead to a system crash, resulting in a Denial of Service (DoS).

This vulnerability is rated as Moderate severity because exploitation is restricted to local vectors requiring physical insertion of a crafted USB device or attachment of virtualized USB hardware, and the resulting impact is confined to a denial of service. The underlying issue affects descriptor handling within the ueagle-atm driver during device probing and unbinding. Standard Red Hat Enterprise Linux installations do not employ these legacy ATM USB modems by default, substantially reducing practical exposure in production environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.