CVE-2026-68327

In the Linux kernel, the following vulnerability has been resolved: wan: wanxl: Only reset hardware after BAR mapping wanxl_pci_init_one() stores the freshly allocated card in driver data before the PLX BAR is mapped. Several early probe failures then unwind through wanxl_pci_remove_one(), including failure to allocate the coherent status area or to restore the DMA mask. wanxl_pci_remove_one() unconditionally calls wanxl_reset(), and wanxl_reset() dereferences card->plx. On those early failures card->plx is still NULL, so the error path can dereference a NULL MMIO pointer. Only issue the hardware reset once the BAR mapping exists. The remaining cleanup in wanxl_pci_remove_one() already checks whether later resources were allocated. This issue was found by a static analysis checker and confirmed by manual source review.

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/2fe22d58b3797d741570f9873b26653fd511576c
https://git.kernel.org/stable/c/3d9617d856ebddcdddbab0ce877c397420f59f55
https://git.kernel.org/stable/c/59cbe6cfa0fa23c192351cc284e30707309f6741
https://git.kernel.org/stable/c/897e289db1e4d00ca6419cfe733c646492147270
https://git.kernel.org/stable/c/91957b89da995607cb654b1f9a3c126ddbaee10f
https://git.kernel.org/stable/c/b9e2ff70e96acf83693b27987e0390bad9f83efa
https://git.kernel.org/stable/c/ef394eeb9d5ec6db8d979eec6d27f56c2ebc6523
https://git.kernel.org/stable/c/f4834132773f15ffb255127499c8443947fa7d0f

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-10 13:20

Updated : 2026-08-19 17:20

NVD link : CVE-2026-68327

Mitre link : CVE-2026-68327

CVE.ORG link : CVE-2026-68327

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-68327", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "ef394eeb9d5ec6db8d979eec6d27f56c2ebc6523", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "3d9617d856ebddcdddbab0ce877c397420f59f55", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "897e289db1e4d00ca6419cfe733c646492147270", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "f4834132773f15ffb255127499c8443947fa7d0f", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "b9e2ff70e96acf83693b27987e0390bad9f83efa", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "59cbe6cfa0fa23c192351cc284e30707309f6741", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "2fe22d58b3797d741570f9873b26653fd511576c", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "91957b89da995607cb654b1f9a3c126ddbaee10f", "versionType": "git"}], "programFiles": ["drivers/net/wan/wanxl.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.12"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.12", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.265", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.216", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.183", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.148", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.101", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.42", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.6", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/wan/wanxl.c"], "defaultStatus": "affected"}]}], "published": "2026-08-10T13:20:22.923", "references": [{"url": "https://git.kernel.org/stable/c/2fe22d58b3797d741570f9873b26653fd511576c", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/3d9617d856ebddcdddbab0ce877c397420f59f55", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/59cbe6cfa0fa23c192351cc284e30707309f6741", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/897e289db1e4d00ca6419cfe733c646492147270", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/91957b89da995607cb654b1f9a3c126ddbaee10f", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b9e2ff70e96acf83693b27987e0390bad9f83efa", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ef394eeb9d5ec6db8d979eec6d27f56c2ebc6523", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f4834132773f15ffb255127499c8443947fa7d0f", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwan: wanxl: Only reset hardware after BAR mapping\n\nwanxl_pci_init_one() stores the freshly allocated card in driver data\nbefore the PLX BAR is mapped. Several early probe failures then unwind\nthrough wanxl_pci_remove_one(), including failure to allocate the coherent\nstatus area or to restore the DMA mask.\n\nwanxl_pci_remove_one() unconditionally calls wanxl_reset(), and\nwanxl_reset() dereferences card->plx. On those early failures card->plx\nis still NULL, so the error path can dereference a NULL MMIO pointer.\n\nOnly issue the hardware reset once the BAR mapping exists. The remaining\ncleanup in wanxl_pci_remove_one() already checks whether later resources\nwere allocated.\n\nThis issue was found by a static analysis checker and confirmed by\nmanual source review."}], "lastModified": "2026-08-19T17:20:43.003", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}