CVE-2026-68327

wan: wanxl: Only reset hardware after BAR mapping

N/A

Published: August 10, 2026 at 12:03 PM UTC

Updated: August 19, 2026 at 05:20 PM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

N/A

Exploit prediction

EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: wan: wanxl: Only reset hardware after BAR mapping wanxl_pci_init_one() stores the freshly allocated card in driver data before the PLX BAR is mapped. Several early probe failures then unwind through wanxl_pci_remove_one(), including failure to allocate the coherent status area or to restore the DMA mask. wanxl_pci_remove_one() unconditionally calls wanxl_reset(), and wanxl_reset() dereferences card->plx. On those early failures card->plx is still NULL, so the error path can dereference a NULL MMIO pointer. Only issue the hardware reset once the BAR mapping exists. The remaining cleanup in wanxl_pci_remove_one() already checks whether later resources were allocated. This issue was found by a static analysis checker and confirmed by manual source review.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

2.6.12 ≤ v < 5.10.2652.6.12 ≤ v < 5.15.2162.6.12 ≤ v < 6.1.1832.6.12 ≤ v < 6.12.1012.6.12 ≤ v < 6.18.422.6.12 ≤ v < 6.6.1482.6.12 ≤ v < 7.1.62.6.12 ≤ v < 7.21da177e4c3f41524e886b7f1b8a0c1fc7321cac2 2.6.12

Vendor states this is fixed in 2fe22d58b3797d741570f9873b26653fd511576c (fixed)

Vendor states this is fixed in 3d9617d856ebddcdddbab0ce877c397420f59f55 (fixed)

Vendor states this is fixed in 59cbe6cfa0fa23c192351cc284e30707309f6741 (fixed)

Vendor states this is fixed in 897e289db1e4d00ca6419cfe733c646492147270 (fixed)

Vendor states this is fixed in 91957b89da995607cb654b1f9a3c126ddbaee10f (fixed)

Vendor states this is fixed in b9e2ff70e96acf83693b27987e0390bad9f83efa (fixed)

Vendor states this is fixed in ef394eeb9d5ec6db8d979eec6d27f56c2ebc6523 (fixed)

Vendor states this is fixed in f4834132773f15ffb255127499c8443947fa7d0f (fixed)

Vendor states this is fixed in 2.6.12 (unaffected)

Vendor states this is fixed in 5.10.265 (unaffected)

Vendor states this is fixed in 5.15.216 (unaffected)

Vendor states this is fixed in 6.1.183 (unaffected)