GHSA-HGPJ-PM42-VW5V

Vulnerability from github – Published: 2026-08-10 15:33 – Updated: 2026-08-19 18:32
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

wan: wanxl: Only reset hardware after BAR mapping

wanxl_pci_init_one() stores the freshly allocated card in driver data before the PLX BAR is mapped. Several early probe failures then unwind through wanxl_pci_remove_one(), including failure to allocate the coherent status area or to restore the DMA mask.

wanxl_pci_remove_one() unconditionally calls wanxl_reset(), and wanxl_reset() dereferences card->plx. On those early failures card->plx is still NULL, so the error path can dereference a NULL MMIO pointer.

Only issue the hardware reset once the BAR mapping exists. The remaining cleanup in wanxl_pci_remove_one() already checks whether later resources were allocated.

This issue was found by a static analysis checker and confirmed by manual source review.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-68327"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-10T13:20:22Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwan: wanxl: Only reset hardware after BAR mapping\n\nwanxl_pci_init_one() stores the freshly allocated card in driver data\nbefore the PLX BAR is mapped.  Several early probe failures then unwind\nthrough wanxl_pci_remove_one(), including failure to allocate the coherent\nstatus area or to restore the DMA mask.\n\nwanxl_pci_remove_one() unconditionally calls wanxl_reset(), and\nwanxl_reset() dereferences card-\u003eplx.  On those early failures card-\u003eplx\nis still NULL, so the error path can dereference a NULL MMIO pointer.\n\nOnly issue the hardware reset once the BAR mapping exists.  The remaining\ncleanup in wanxl_pci_remove_one() already checks whether later resources\nwere allocated.\n\nThis issue was found by a static analysis checker and confirmed by\nmanual source review.",
  "id": "GHSA-hgpj-pm42-vw5v",
  "modified": "2026-08-19T18:32:14Z",
  "published": "2026-08-10T15:33:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68327"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2fe22d58b3797d741570f9873b26653fd511576c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3d9617d856ebddcdddbab0ce877c397420f59f55"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/59cbe6cfa0fa23c192351cc284e30707309f6741"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/897e289db1e4d00ca6419cfe733c646492147270"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/91957b89da995607cb654b1f9a3c126ddbaee10f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b9e2ff70e96acf83693b27987e0390bad9f83efa"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ef394eeb9d5ec6db8d979eec6d27f56c2ebc6523"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f4834132773f15ffb255127499c8443947fa7d0f"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.