CVE-2026-68327
In the Linux kernel, the following vulnerability has been resolved: wan: wanxl: Only reset hardware after BAR mapping wanxl_pci_init_one() stores the freshly allocated card in driver data before the PLX BAR is mapped. Several early probe failures then unwind through wanxl_pci_remove_one(), including failure to allocate the coherent status area or to restore the DMA mask. wanxl_pci_remove_one() unconditionally calls wanxl_reset(), and wanxl_reset() dereferences card->plx. On those early failures card->plx is still NULL, so the error path can dereference a NULL MMIO pointer. Only issue the hardware reset once the BAR mapping exists. The remaining cleanup in wanxl_pci_remove_one() already checks whether later resources were allocated. This issue was found by a static analysis checker and confirmed by manual source review.
Affected versions
Linux kernel versions
2.6.12
and later are affected. Fixed in
5.10.265,
5.15.216,
6.1.183,
6.6.148,
6.12.101,
6.18.42,
7.1.6,
7.2
and their respective stable series.
References
8 totalFrequently asked questions
-
What is CVE-2026-68327?
CVE-2026-68327 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 2.6.12 onward and has been patched in 5.10.265, 5.15.216, 6.1.183 and others. CVE-2026-68327 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-68327?
Yes. CVE-2026-68327 has been patched. Fixed versions include 5.10.265, 5.15.216, 6.1.183 and others. If you are running Linux kernel 2.6.12 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-68327 actively exploited?
No. CVE-2026-68327 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.