net: usb: ipheth: fix carrier_work UAF on disconnect

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-74677
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-08-22 16:16:41 UTC
Updated2026-08-22 16:16:41 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: net: usb: ipheth: fix carrier_work UAF on disconnect ipheth_sndbulk_callback() re-arms the carrier-check work on any non-zero URB status: else schedule_delayed_work(&dev->carrier_work, 0); Nothing ties that to the interface being up, so the work can be armed again after ipheth_close() has already drained it, and stay armed until the netdev whose private area embeds it is freed. On unplug with a TX URB in flight, ipheth_disconnect() drains the work through unregister_netdev() -> ipheth_close() -> cancel_delayed_work_sync() and only then calls ipheth_kill_urbs(). usb_kill_urb() completes the in-flight TX URB with -ENOENT, so ipheth_sndbulk_callback() runs after the drain and re-arms carrier_work. The same completion also re-arms the work if the interface is only brought down while a TX URB is in flight, and ipheth_carrier_check_work() then keeps re-queueing itself once a second. unregister_netdev() does not call ipheth_close() for an already-down interface, so nothing drains it on the later unplug either. In both cases free_netdev() frees the netdev while carrier_work is still pending, and ipheth_carrier_check_work() dereferences freed memory. Tie the work to the interface state instead of chasing the completion: disable it in ipheth_close() and enable it in ipheth_open(), so a schedule_delayed_work() from the URB completion is a no-op whenever the interface is not up. disable_delayed_work_sync() also waits for a running instance, so it fully replaces the cancel_delayed_work_sync() it takes the place of. The work starts out disabled in ipheth_probe() so the enable/disable counts balance from the first open. Reproduced under KASAN on linux-next (next-20260731) with dummy_hcd and raw-gadget standing in for the device, driving the second path above (the interface is already down, so unregister_netdev() does not call ipheth_close()): 15 of 15 unpatched boots report a slab-use-after-free in __run_timers(), freed by ipheth_disconnect() and re-armed from ipheth_sndbulk_callback() via queue_delayed_work_on(). The same trigger on a kernel differing only by this patch reports 0 of 15, and the carrier check still functions across open/close cycles. The reproducer needs an attached USB device that stops draining bulk OUT, plus a link down and unplug, driven as root. It is not a privilege boundary crossing and no exploit primitive was developed. Found by 0sec (https://0sec.ai).

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected bb1b40c7cb863f0800a6410c7dcb86cf3f28d3b1 d07133fe1befae9a1e4c4c5e46ef0b73d2992020 git Not specified
CNA Linux Linux affected bb1b40c7cb863f0800a6410c7dcb86cf3f28d3b1 2c7496124e94c7f9c3daa5c5b1fb563ca9d62c45 git Not specified
CNA Linux Linux affected bb1b40c7cb863f0800a6410c7dcb86cf3f28d3b1 48303f3ae0fa6e102f3fc7dbf1688cc179131962 git Not specified
CNA Linux Linux affected bb1b40c7cb863f0800a6410c7dcb86cf3f28d3b1 fde39b8a521780391fb4e5bda2c0aa4928947f12 git Not specified
CNA Linux Linux affected 4f2df9fd07698bece3321fbf9e4b6dbcb9babccc git Not specified
CNA Linux Linux affected ea7d6be58c2e6c1f426b48994bb22b2393c90963 git Not specified
CNA Linux Linux affected f5bca75dc46701f4c0d1dcbaae401233ae7ff06b git Not specified
CNA Linux Linux affected 4.4.180 4.5 semver Not specified
CNA Linux Linux affected 4.9.173 4.10 semver Not specified
CNA Linux Linux affected 4.14.116 4.15 semver Not specified
CNA Linux Linux affected 4.15 Not specified
CNA Linux Linux unaffected 4.15 semver Not specified
CNA Linux Linux unaffected 6.12.104 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.45 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.9 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/d07133fe1befae9a1e4c4c5e46ef0b73d2992020 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/fde39b8a521780391fb4e5bda2c0aa4928947f12 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/2c7496124e94c7f9c3daa5c5b1fb563ca9d62c45 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/48303f3ae0fa6e102f3fc7dbf1688cc179131962 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report