The ueagle‑atm USB ATM driver contains a type‑confusion flaw (CWE‑843). When a device advertises a pre‑firmware identifier with an interface count that does not match the firmware type, the probe and disconnect routines disagree on the data structure stored for the device. The disconnect handler then casts a small struct into a larger one and reads past the end of the allocation, triggering an out‑of‑bounds read that can corrupt kernel memory or cause a kernel panic. This memory corruption can lead to a denial of service at the kernel level.

All Linux kernel builds that include the ueagle‑atm driver prior to the commit that rejects incompatible descriptors are susceptible. The vendor information is generic Linux; any kernel containing the affected probe or disconnect code path is at risk until the patch is applied.

The CVSS score of 5.5 indicates medium severity, while the EPSS score of <1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation. An attacker can likely exploit this by presenting a malicious USB ATM device that combines a pre‑firmware identifier with a multi‑interface descriptor or vice versa, causing the driver to misinterpret the device type. The resulting out‑of‑bounds read can corrupt kernel memory, potentially leading to a crash or denial of service. Because the driver runs with kernel privileges, an attacker gaining access to this code path may also increase the chances of additional attacks if other kernel weaknesses exist.