CVE-2026-68456: In the Linux kernel, the following vulnerability has been resolved: usb: atm: ueagle-atm: wait for pre-firmware load in
Summary
A vulnerability in the Linux kernel's ueagle-atm USB driver occurs because it loads firmware asynchronously (request_firmware_nowait(), a non-blocking function that continues without waiting for firmware to load) but doesn't wait for it to finish before unplugging the device, causing the firmware sysfs fallback mechanism (CONFIG_FW_LOADER_USER_HELPER, a method to load firmware through user space when direct loading fails) to race with device teardown and create errors in kernfs (the Linux kernel's file system interface). This race condition has triggered multiple bug reports over several years when devices are unplugged during firmware loading.
Solution / Mitigation
The fix involves waiting for the pre-firmware load in the .disconnect() handler by calling wait_for_completion() in the device disconnection function, ensuring the firmware load completes before the device is torn down.
Vulnerability Details
EPSS: 0.0%
August 15, 2026
Classification
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-68456
First tracked: August 15, 2026 at 08:08 AM
Classified by LLM (prompt v3) · confidence: 95%