CVE-2026-68327: wan: wanxl: Only reset hardware after BAR mapping
In the Linux kernel, the following vulnerability has been resolved:
wan: wanxl: Only reset hardware after BAR mapping
wanxlpciinitone() stores the freshly allocated card in driver data before the PLX BAR is mapped. Several early probe failures then unwind through wanxlpciremoveone(), including failure to allocate the coherent status area or to restore the DMA mask.
wanxlpciremoveone() unconditionally calls wanxlreset(), and wanxlreset() dereferences card->plx. On those early failures card->plx is still NULL, so the error path can dereference a NULL MMIO pointer.
Only issue the hardware reset once the BAR mapping exists. The remaining cleanup in wanxlpciremoveone() already checks whether later resources were allocated.
This issue was found by a static analysis checker and confirmed by manual source review.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.150.1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68327?
CVE-2026-68327 has been assigned a risk score of 13.
How does CVE-2026-68327 affect the Linux kernel?
CVE-2026-68327 affects the Linux kernel by improperly resetting hardware before the PLX BAR is mapped.
What are the implications of CVE-2026-68327 for system stability?
CVE-2026-68327 can lead to early probe failures which may negatively impact system stability.
What is the proposed solution to address CVE-2026-68327?
The proposed solution for CVE-2026-68327 is to adjust the order of operations in the wanxl_pci_init_one() function.
When was CVE-2026-68327 published?
CVE-2026-68327 was published on August 10, 2026.