CVE-2026-68456

A flaw was found in the Linux kernel's ueagle-atm USB driver. This driver uses an asynchronous mechanism for loading firmware but does not wait for its completion when a device is disconnected. This creates a race condition where the device's teardown can run concurrently with firmware loading. If a device is unplugged during this process, it can lead to unexpected conditions in the kernel's file system (kernfs), potentially causing system instability or a denial of service.

Red Hat has classified this vulnerability as having Moderate severity because exploitation requires local access and the physical attachment or detachment of specific Eagle USB ATM hardware, confining the blast radius strictly to a local denial of service. Typical enterprise server deployments do not use legacy USB ADSL modems, substantially reducing real-world exposure in production environments. Furthermore, the issue cannot be triggered remotely and does not enable privilege escalation or compromise data confidentiality and integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.