CVE-2026-74678 (GCVE-0-2026-74678)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:32 – Updated: 2026-10-16 19:16
VLAI
Title
net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()
Summary
In the Linux kernel, the following vulnerability has been resolved: net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() When the interface has NETIF_F_SG enabled and skb_linearize() fails in ax88179_tx_fixup(), the function returns NULL without freeing the skb. usbnet_start_xmit() treats a NULL return from tx_fixup() as a drop (info->flags does not set FLAG_MULTI_PACKET for this driver), jumping to the "drop" label where it does `if (skb) dev_kfree_skb_any(skb)`. Because tx_fixup() returned NULL, the local skb variable in usbnet_start_xmit() is NULL, so the original skb is never freed — a memory leak on every TX frame whose linearization fails (i.e. under memory pressure). Free the skb before returning, matching the error handling already used for the pskb_expand_head() failure path in the same function.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 19:14 UTC
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 7018 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 16b1c4e01c89ba07367461e0bc4cb84993c2d027 , < 83a765cbd7b4d11b0b9fa1bb9d941ae911a2159b (git)
Affected: 16b1c4e01c89ba07367461e0bc4cb84993c2d027 , < 1c63303659a2264bd55d9813df74cb4caeed5922 (git)
Affected: 16b1c4e01c89ba07367461e0bc4cb84993c2d027 , < 2be5091fa693b9119ad25a8bb8c149d236a23ade (git)
Affected: 16b1c4e01c89ba07367461e0bc4cb84993c2d027 , < 58733b1dd46bb231d9d279c132a20ee46da1b664 (git)
Affected: 16b1c4e01c89ba07367461e0bc4cb84993c2d027 , < 4039cd807a5a46dc5f7618fffae926b8ad8455eb (git)
Affected: 16b1c4e01c89ba07367461e0bc4cb84993c2d027 , < 1f428e30947395d9b9aacee03e25a4e6cfcad7a4 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.17
Unaffected: 0 , < 5.17 (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.152 , ≤ 6.6.* (semver)
Unaffected: 6.12.104 , ≤ 6.12.* (semver)
Unaffected: 6.18.45 , ≤ 6.18.* (semver)
Unaffected: 7.1.9 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-74678",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:14:27.464572Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:16:08.884Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/usb/ax88179_178a.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "83a765cbd7b4d11b0b9fa1bb9d941ae911a2159b",
              "status": "affected",
              "version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
              "versionType": "git"
            },
            {
              "lessThan": "1c63303659a2264bd55d9813df74cb4caeed5922",
              "status": "affected",
              "version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
              "versionType": "git"
            },
            {
              "lessThan": "2be5091fa693b9119ad25a8bb8c149d236a23ade",
              "status": "affected",
              "version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
              "versionType": "git"
            },
            {
              "lessThan": "58733b1dd46bb231d9d279c132a20ee46da1b664",
              "status": "affected",
              "version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
              "versionType": "git"
            },
            {
              "lessThan": "4039cd807a5a46dc5f7618fffae926b8ad8455eb",
              "status": "affected",
              "version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
              "versionType": "git"
            },
            {
              "lessThan": "1f428e30947395d9b9aacee03e25a4e6cfcad7a4",
              "status": "affected",
              "version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/usb/ax88179_178a.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()\n\nWhen the interface has NETIF_F_SG enabled and skb_linearize() fails in\nax88179_tx_fixup(), the function returns NULL without freeing the skb.\n\nusbnet_start_xmit() treats a NULL return from tx_fixup() as a drop\n(info-\u003eflags does not set FLAG_MULTI_PACKET for this driver), jumping\nto the \"drop\" label where it does `if (skb) dev_kfree_skb_any(skb)`.\nBecause tx_fixup() returned NULL, the local skb variable in\nusbnet_start_xmit() is NULL, so the original skb is never freed \u2014 a\nmemory leak on every TX frame whose linearization fails (i.e. under\nmemory pressure).\n\nFree the skb before returning, matching the error handling already used\nfor the pskb_expand_head() failure path in the same function."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - On systems using the common ASIX AX88179/AX88178A USB 3.0 GbE adapter as their uplink, remote peers induce outbound TSO/GSO traffic that reaches ax88179_tx_fixup() via __dev_queue_xmit\u2192netdev_start_xmit\u2192usbnet_start_xmit; attacker-supplied or reply traffic over the bound NIC is standard network reachability.\nAC:L - NETIF_F_SG and NETIF_F_TSO are always enabled at bind; an attacker can send non-linear egress skbs and deliberately exhaust GFP_ATOMIC/slab memory so skb_linearize() fails on demand\u2014both prerequisites are fully under attacker control without races or rare layout.\nPR:N - No capability or authentication gates the netdev TX path; any remote host exchanging IP traffic with a victim whose ax88179 interface is up can trigger usbnet_start_xmit without local shell access, credentials, or init-namespace privileges.\nUI:N - Exploitation needs only that the adapter is plugged in and carrying traffic\u2014the normal always-on state for USB-Ethernet docks, kiosks, and laptops\u2014not any one-time victim action such as mounting media or opening a file.\nS:U - Leaked sk_buff objects remain in kernel SLAB caches within the same kernel security authority; there is no VM escape, container breakout, IOMMU bypass, or cross-boundary corruption.\nC:N - Orphaned skbs are not freed but are not exposed to userspace or adjacent objects; there is no out-of-bounds read, use-after-free, or other disclosure primitive\u2014only silent kernel heap consumption.\nI:N - The defect drops an skb reference on an error return without corrupting heap metadata, overwriting kernel objects, or enabling arbitrary writes or control-flow hijacking.\nA:H - Each skb_linearize() failure permanently leaks one skb; under attacker-driven memory pressure an unauthenticated remote peer can repeat TSO egress to exhaust kernel memory, provoking OOM-killer thrashing and denial of service on the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:41:29.048Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/83a765cbd7b4d11b0b9fa1bb9d941ae911a2159b"
        },
        {
          "url": "https://git.kernel.org/stable/c/1c63303659a2264bd55d9813df74cb4caeed5922"
        },
        {
          "url": "https://git.kernel.org/stable/c/2be5091fa693b9119ad25a8bb8c149d236a23ade"
        },
        {
          "url": "https://git.kernel.org/stable/c/58733b1dd46bb231d9d279c132a20ee46da1b664"
        },
        {
          "url": "https://git.kernel.org/stable/c/4039cd807a5a46dc5f7618fffae926b8ad8455eb"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f428e30947395d9b9aacee03e25a4e6cfcad7a4"
        }
      ],
      "title": "net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74678",
    "datePublished": "2026-08-22T15:32:46.765Z",
    "dateReserved": "2026-08-15T05:44:03.925Z",
    "dateUpdated": "2026-10-16T19:16:08.884Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74678",
      "date": "2026-11-01",
      "epss": "0.00479",
      "percentile": "0.41337"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-25T02:26:24.000Z",
      "cve": "CVE-2026-74678",
      "id": "msrc_CVE-2026-74678",
      "initial_release_date": "2026-08-24T01:01:58.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74678.json",
      "version": "4"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/usb/ax88179_178a.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "83a765cbd7b4d11b0b9fa1bb9d941ae911a2159b",
                    "status": "affected",
                    "version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1c63303659a2264bd55d9813df74cb4caeed5922",
                    "status": "affected",
                    "version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2be5091fa693b9119ad25a8bb8c149d236a23ade",
                    "status": "affected",
                    "version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "58733b1dd46bb231d9d279c132a20ee46da1b664",
                    "status": "affected",
                    "version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4039cd807a5a46dc5f7618fffae926b8ad8455eb",
                    "status": "affected",
                    "version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1f428e30947395d9b9aacee03e25a4e6cfcad7a4",
                    "status": "affected",
                    "version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/usb/ax88179_178a.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.17"
                  },
                  {
                    "lessThan": "5.17",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.183",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.152",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.104",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.45",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.9",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()\n\nWhen the interface has NETIF_F_SG enabled and skb_linearize() fails in\nax88179_tx_fixup(), the function returns NULL without freeing the skb.\n\nusbnet_start_xmit() treats a NULL return from tx_fixup() as a drop\n(info-\u003eflags does not set FLAG_MULTI_PACKET for this driver), jumping\nto the \"drop\" label where it does `if (skb) dev_kfree_skb_any(skb)`.\nBecause tx_fixup() returned NULL, the local skb variable in\nusbnet_start_xmit() is NULL, so the original skb is never freed \u2014 a\nmemory leak on every TX frame whose linearization fails (i.e. under\nmemory pressure).\n\nFree the skb before returning, matching the error handling already used\nfor the pskb_expand_head() failure path in the same function."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: usb: ax88179_178a: corrige fuga de skb en ax88179_tx_fixup()\n\nCuando la interfaz tiene NETIF_F_SG habilitado y skb_linearize() falla en ax88179_tx_fixup(), la funci\u00f3n devuelve NULL sin liberar el skb.\n\nusbnet_start_xmit() trata un retorno NULL de tx_fixup() como un descarte (info -\u003e flags no establece FLAG_MULTI_PACKET para este controlador), saltando a la etiqueta \u0027drop\u0027 donde hace \u0027if (skb) dev_kfree_skb_any(skb)\u0027. Debido a que tx_fixup() devolvi\u00f3 NULL, la variable local skb en usbnet_start_xmit() es NULL, por lo que el skb original nunca se libera - una fuga de memoria en cada trama TX cuya linealizaci\u00f3n falla (es decir, bajo presi\u00f3n de memoria).\n\nLibere el skb antes de retornar, coincidiendo con el manejo de errores ya utilizado para la ruta de fallo de pskb_expand_head() en la misma funci\u00f3n."
          }
        ],
        "id": "CVE-2026-74678",
        "lastModified": "2026-10-16T20:17:51.433",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-74678",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:14:27.464572Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-22T16:16:41.980",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1c63303659a2264bd55d9813df74cb4caeed5922"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1f428e30947395d9b9aacee03e25a4e6cfcad7a4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2be5091fa693b9119ad25a8bb8c149d236a23ade"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4039cd807a5a46dc5f7618fffae926b8ad8455eb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/58733b1dd46bb231d9d279c132a20ee46da1b664"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/83a765cbd7b4d11b0b9fa1bb9d941ae911a2159b"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-10-29T13:09:36+00:00",
      "cve": "CVE-2026-74678",
      "id": "CVE-2026-74678",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "44",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74678.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-74678",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-16T19:14:27.464572Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-16T19:14:28.034Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/net/usb/ax88179_178a.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "83a765cbd7b4d11b0b9fa1bb9d941ae911a2159b",
                  "status": "affected",
                  "version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
                  "versionType": "git"
                },
                {
                  "lessThan": "1c63303659a2264bd55d9813df74cb4caeed5922",
                  "status": "affected",
                  "version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
                  "versionType": "git"
                },
                {
                  "lessThan": "2be5091fa693b9119ad25a8bb8c149d236a23ade",
                  "status": "affected",
                  "version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
                  "versionType": "git"
                },
                {
                  "lessThan": "58733b1dd46bb231d9d279c132a20ee46da1b664",
                  "status": "affected",
                  "version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
                  "versionType": "git"
                },
                {
                  "lessThan": "4039cd807a5a46dc5f7618fffae926b8ad8455eb",
                  "status": "affected",
                  "version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
                  "versionType": "git"
                },
                {
                  "lessThan": "1f428e30947395d9b9aacee03e25a4e6cfcad7a4",
                  "status": "affected",
                  "version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/net/usb/ax88179_178a.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.17"
                },
                {
                  "lessThan": "5.17",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.183",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.152",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.12.*",
                  "status": "unaffected",
                  "version": "6.12.104",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.18.*",
                  "status": "unaffected",
                  "version": "6.18.45",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.1.*",
                  "status": "unaffected",
                  "version": "7.1.9",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "7.2",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.183",
                      "versionStartIncluding": "5.17",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.152",
                      "versionStartIncluding": "5.17",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.12.104",
                      "versionStartIncluding": "5.17",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.18.45",
                      "versionStartIncluding": "5.17",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "7.1.9",
                      "versionStartIncluding": "5.17",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "7.2",
                      "versionStartIncluding": "5.17",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()\n\nWhen the interface has NETIF_F_SG enabled and skb_linearize() fails in\nax88179_tx_fixup(), the function returns NULL without freeing the skb.\n\nusbnet_start_xmit() treats a NULL return from tx_fixup() as a drop\n(info-\u003eflags does not set FLAG_MULTI_PACKET for this driver), jumping\nto the \"drop\" label where it does `if (skb) dev_kfree_skb_any(skb)`.\nBecause tx_fixup() returned NULL, the local skb variable in\nusbnet_start_xmit() is NULL, so the original skb is never freed \u2014 a\nmemory leak on every TX frame whose linearization fails (i.e. under\nmemory pressure).\n\nFree the skb before returning, matching the error handling already used\nfor the pskb_expand_head() failure path in the same function."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:N - On systems using the common ASIX AX88179/AX88178A USB 3.0 GbE adapter as their uplink, remote peers induce outbound TSO/GSO traffic that reaches ax88179_tx_fixup() via __dev_queue_xmit\u2192netdev_start_xmit\u2192usbnet_start_xmit; attacker-supplied or reply traffic over the bound NIC is standard network reachability.\nAC:L - NETIF_F_SG and NETIF_F_TSO are always enabled at bind; an attacker can send non-linear egress skbs and deliberately exhaust GFP_ATOMIC/slab memory so skb_linearize() fails on demand\u2014both prerequisites are fully under attacker control without races or rare layout.\nPR:N - No capability or authentication gates the netdev TX path; any remote host exchanging IP traffic with a victim whose ax88179 interface is up can trigger usbnet_start_xmit without local shell access, credentials, or init-namespace privileges.\nUI:N - Exploitation needs only that the adapter is plugged in and carrying traffic\u2014the normal always-on state for USB-Ethernet docks, kiosks, and laptops\u2014not any one-time victim action such as mounting media or opening a file.\nS:U - Leaked sk_buff objects remain in kernel SLAB caches within the same kernel security authority; there is no VM escape, container breakout, IOMMU bypass, or cross-boundary corruption.\nC:N - Orphaned skbs are not freed but are not exposed to userspace or adjacent objects; there is no out-of-bounds read, use-after-free, or other disclosure primitive\u2014only silent kernel heap consumption.\nI:N - The defect drops an skb reference on an error return without corrupting heap metadata, overwriting kernel objects, or enabling arbitrary writes or control-flow hijacking.\nA:H - Each skb_linearize() failure permanently leaks one skb; under attacker-driven memory pressure an unauthenticated remote peer can repeat TSO egress to exhaust kernel memory, provoking OOM-killer thrashing and denial of service on the host."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-25T05:41:29.048Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/83a765cbd7b4d11b0b9fa1bb9d941ae911a2159b"
            },
            {
              "url": "https://git.kernel.org/stable/c/1c63303659a2264bd55d9813df74cb4caeed5922"
            },
            {
              "url": "https://git.kernel.org/stable/c/2be5091fa693b9119ad25a8bb8c149d236a23ade"
            },
            {
              "url": "https://git.kernel.org/stable/c/58733b1dd46bb231d9d279c132a20ee46da1b664"
            },
            {
              "url": "https://git.kernel.org/stable/c/4039cd807a5a46dc5f7618fffae926b8ad8455eb"
            },
            {
              "url": "https://git.kernel.org/stable/c/1f428e30947395d9b9aacee03e25a4e6cfcad7a4"
            }
          ],
          "title": "net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2026-74678",
        "datePublished": "2026-08-22T15:32:46.765Z",
        "dateReserved": "2026-08-15T05:44:03.925Z",
        "dateUpdated": "2026-10-16T19:16:08.884Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.