CVE-2026-68327

wan: wanxl: Only reset hardware after BAR mapping

State: Published
Severity: Not scored
Published: Aug 10, 2026
Updated: Aug 19, 2026
Reserved: Jul 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wan: wanxl: Only reset hardware after BAR mapping

wanxl_pci_init_one() stores the freshly allocated card in driver data before the PLX BAR is mapped. Several early probe failures then unwind through wanxl_pci_remove_one(), including failure to allocate the coherent status area or to restore the DMA mask.

wanxl_pci_remove_one() unconditionally calls wanxl_reset(), and wanxl_reset() dereferences card->plx. On those early failures card->plx is still NULL, so the error path can dereference a NULL MMIO pointer.

Only issue the hardware reset once the BAR mapping exists. The remaining cleanup in wanxl_pci_remove_one() already checks whether later resources were allocated.

This issue was found by a static analysis checker and confirmed by manual source review.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before ef394eeb9d5ec6db8d979eec6d27f56c2ebc6523Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 3d9617d856ebddcdddbab0ce877c397420f59f55Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 897e289db1e4d00ca6419cfe733c646492147270Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before f4834132773f15ffb255127499c8443947fa7d0fAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b9e2ff70e96acf83693b27987e0390bad9f83efaAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 59cbe6cfa0fa23c192351cc284e30707309f6741Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 2fe22d58b3797d741570f9873b26653fd511576cAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 91957b89da995607cb654b1f9a3c126ddbaee10fAffected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 5.10.265 through 5.10.Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.148 through 6.6.Not affected 6.12.101 through 6.12.Not affected 6.18.42 through 6.18.Not affected 7.1.6 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before ef394eeb9d5ec6db8d979eec6d27f56c2ebc6523Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 3d9617d856ebddcdddbab0ce877c397420f59f55Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 897e289db1e4d00ca6419cfe733c646492147270Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before f4834132773f15ffb255127499c8443947fa7d0fAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b9e2ff70e96acf83693b27987e0390bad9f83efaAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 59cbe6cfa0fa23c192351cc284e30707309f6741Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 2fe22d58b3797d741570f9873b26653fd511576cAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 91957b89da995607cb654b1f9a3c126ddbaee10fAffected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
5.10.265 through 5.10.*Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.148 through 6.6.*Not affected
6.12.101 through 6.12.*Not affected
6.18.42 through 6.18.*Not affected
7.1.6 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.