In the Linux kernel, the following vulnerability has been resolved:
net: mctp: usb: fix race between urb completion and rx_retry cancellation
It's possible that sequencing between setting ->stopped and cancelling
the rx_retry work (in ndo_stop) could leave us with an urb queued:
T1: ndo_stop T2: rx_retry_work
------------ ----------------
LD: ->stopped => false
ST: ->stopped <= true
usb_kill_urb()
mctp_usb_rx_queue()
usb_submit_urb()
cancel_delayed_work_sync()
That urb completion can then re-schedule rx_retry_work.
Strenghen the sequencing between the stop (preventing another requeue)
and the cancel by updating both atomically under a new rx lock. After
setting ->rx_stopped, and cancelling pending work, we know that the
requeue cannot occur, so all that's left is killing any pending urb.
References
Configurations
Configuration 1 (hide)
|
History
30 Oct 2026, 14:55
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://git.kernel.org/stable/c/54665dce982689e2fd99b32e9a0dcc204fda8a51 - Patch | |
| References | () https://git.kernel.org/stable/c/9c46f3ee1837f6881cb99a52ffecb2760f11dc73 - Patch | |
| References | () https://git.kernel.org/stable/c/d90feaa3f74bea8dafb6494631a194c70e547d94 - Patch | |
| CPE | cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc7:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* |
|
| First Time |
Linux linux Kernel
Linux |
|
| CWE | CWE-362 |
Information
Published : 2026-07-19 15:16
Updated : 2026-10-30 14:55
NVD link : CVE-2026-63874
Mitre link : CVE-2026-63874
CVE.ORG link : CVE-2026-63874
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')