CVE-2026-74678 (GCVE-0-2026-74678)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:32 – Updated: 2026-08-25 05:41
VLAI
Title
net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()
Summary
In the Linux kernel, the following vulnerability has been resolved: net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() When the interface has NETIF_F_SG enabled and skb_linearize() fails in ax88179_tx_fixup(), the function returns NULL without freeing the skb. usbnet_start_xmit() treats a NULL return from tx_fixup() as a drop (info->flags does not set FLAG_MULTI_PACKET for this driver), jumping to the "drop" label where it does `if (skb) dev_kfree_skb_any(skb)`. Because tx_fixup() returned NULL, the local skb variable in usbnet_start_xmit() is NULL, so the original skb is never freed — a memory leak on every TX frame whose linearization fails (i.e. under memory pressure). Free the skb before returning, matching the error handling already used for the pskb_expand_head() failure path in the same function.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 16b1c4e01c89ba07367461e0bc4cb84993c2d027 , < 83a765cbd7b4d11b0b9fa1bb9d941ae911a2159b (git)
Affected: 16b1c4e01c89ba07367461e0bc4cb84993c2d027 , < 1c63303659a2264bd55d9813df74cb4caeed5922 (git)
Affected: 16b1c4e01c89ba07367461e0bc4cb84993c2d027 , < 2be5091fa693b9119ad25a8bb8c149d236a23ade (git)
Affected: 16b1c4e01c89ba07367461e0bc4cb84993c2d027 , < 58733b1dd46bb231d9d279c132a20ee46da1b664 (git)
Affected: 16b1c4e01c89ba07367461e0bc4cb84993c2d027 , < 4039cd807a5a46dc5f7618fffae926b8ad8455eb (git)
Affected: 16b1c4e01c89ba07367461e0bc4cb84993c2d027 , < 1f428e30947395d9b9aacee03e25a4e6cfcad7a4 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.17
Unaffected: 0 , < 5.17 (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.152 , ≤ 6.6.* (semver)
Unaffected: 6.12.104 , ≤ 6.12.* (semver)
Unaffected: 6.18.45 , ≤ 6.18.* (semver)
Unaffected: 7.1.9 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/usb/ax88179_178a.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "83a765cbd7b4d11b0b9fa1bb9d941ae911a2159b",
              "status": "affected",
              "version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
              "versionType": "git"
            },
            {
              "lessThan": "1c63303659a2264bd55d9813df74cb4caeed5922",
              "status": "affected",
              "version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
              "versionType": "git"
            },
            {
              "lessThan": "2be5091fa693b9119ad25a8bb8c149d236a23ade",
              "status": "affected",
              "version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
              "versionType": "git"
            },
            {
              "lessThan": "58733b1dd46bb231d9d279c132a20ee46da1b664",
              "status": "affected",
              "version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
              "versionType": "git"
            },
            {
              "lessThan": "4039cd807a5a46dc5f7618fffae926b8ad8455eb",
              "status": "affected",
              "version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
              "versionType": "git"
            },
            {
              "lessThan": "1f428e30947395d9b9aacee03e25a4e6cfcad7a4",
              "status": "affected",
              "version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/usb/ax88179_178a.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()\n\nWhen the interface has NETIF_F_SG enabled and skb_linearize() fails in\nax88179_tx_fixup(), the function returns NULL without freeing the skb.\n\nusbnet_start_xmit() treats a NULL return from tx_fixup() as a drop\n(info-\u003eflags does not set FLAG_MULTI_PACKET for this driver), jumping\nto the \"drop\" label where it does `if (skb) dev_kfree_skb_any(skb)`.\nBecause tx_fixup() returned NULL, the local skb variable in\nusbnet_start_xmit() is NULL, so the original skb is never freed \u2014 a\nmemory leak on every TX frame whose linearization fails (i.e. under\nmemory pressure).\n\nFree the skb before returning, matching the error handling already used\nfor the pskb_expand_head() failure path in the same function."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - On systems using the common ASIX AX88179/AX88178A USB 3.0 GbE adapter as their uplink, remote peers induce outbound TSO/GSO traffic that reaches ax88179_tx_fixup() via __dev_queue_xmit\u2192netdev_start_xmit\u2192usbnet_start_xmit; attacker-supplied or reply traffic over the bound NIC is standard network reachability.\nAC:L - NETIF_F_SG and NETIF_F_TSO are always enabled at bind; an attacker can send non-linear egress skbs and deliberately exhaust GFP_ATOMIC/slab memory so skb_linearize() fails on demand\u2014both prerequisites are fully under attacker control without races or rare layout.\nPR:N - No capability or authentication gates the netdev TX path; any remote host exchanging IP traffic with a victim whose ax88179 interface is up can trigger usbnet_start_xmit without local shell access, credentials, or init-namespace privileges.\nUI:N - Exploitation needs only that the adapter is plugged in and carrying traffic\u2014the normal always-on state for USB-Ethernet docks, kiosks, and laptops\u2014not any one-time victim action such as mounting media or opening a file.\nS:U - Leaked sk_buff objects remain in kernel SLAB caches within the same kernel security authority; there is no VM escape, container breakout, IOMMU bypass, or cross-boundary corruption.\nC:N - Orphaned skbs are not freed but are not exposed to userspace or adjacent objects; there is no out-of-bounds read, use-after-free, or other disclosure primitive\u2014only silent kernel heap consumption.\nI:N - The defect drops an skb reference on an error return without corrupting heap metadata, overwriting kernel objects, or enabling arbitrary writes or control-flow hijacking.\nA:H - Each skb_linearize() failure permanently leaks one skb; under attacker-driven memory pressure an unauthenticated remote peer can repeat TSO egress to exhaust kernel memory, provoking OOM-killer thrashing and denial of service on the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:41:29.048Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/83a765cbd7b4d11b0b9fa1bb9d941ae911a2159b"
        },
        {
          "url": "https://git.kernel.org/stable/c/1c63303659a2264bd55d9813df74cb4caeed5922"
        },
        {
          "url": "https://git.kernel.org/stable/c/2be5091fa693b9119ad25a8bb8c149d236a23ade"
        },
        {
          "url": "https://git.kernel.org/stable/c/58733b1dd46bb231d9d279c132a20ee46da1b664"
        },
        {
          "url": "https://git.kernel.org/stable/c/4039cd807a5a46dc5f7618fffae926b8ad8455eb"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f428e30947395d9b9aacee03e25a4e6cfcad7a4"
        }
      ],
      "title": "net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74678",
    "datePublished": "2026-08-22T15:32:46.765Z",
    "dateReserved": "2026-08-15T05:44:03.925Z",
    "dateUpdated": "2026-08-25T05:41:29.048Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74678",
      "date": "2026-08-29",
      "epss": "0.00479",
      "percentile": "0.39327"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-24T14:46:29.000Z",
      "cve": "CVE-2026-74678",
      "id": "msrc_CVE-2026-74678",
      "initial_release_date": "2026-08-24T01:01:58.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74678.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74678\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-22T16:16:41.980\",\"lastModified\":\"2026-08-25T06:18:50.740\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()\\n\\nWhen the interface has NETIF_F_SG enabled and skb_linearize() fails in\\nax88179_tx_fixup(), the function returns NULL without freeing the skb.\\n\\nusbnet_start_xmit() treats a NULL return from tx_fixup() as a drop\\n(info-\u003eflags does not set FLAG_MULTI_PACKET for this driver), jumping\\nto the \\\"drop\\\" label where it does `if (skb) dev_kfree_skb_any(skb)`.\\nBecause tx_fixup() returned NULL, the local skb variable in\\nusbnet_start_xmit() is NULL, so the original skb is never freed \u2014 a\\nmemory leak on every TX frame whose linearization fails (i.e. under\\nmemory pressure).\\n\\nFree the skb before returning, matching the error handling already used\\nfor the pskb_expand_head() failure path in the same function.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/usb/ax88179_178a.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"16b1c4e01c89ba07367461e0bc4cb84993c2d027\",\"lessThan\":\"83a765cbd7b4d11b0b9fa1bb9d941ae911a2159b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"16b1c4e01c89ba07367461e0bc4cb84993c2d027\",\"lessThan\":\"1c63303659a2264bd55d9813df74cb4caeed5922\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"16b1c4e01c89ba07367461e0bc4cb84993c2d027\",\"lessThan\":\"2be5091fa693b9119ad25a8bb8c149d236a23ade\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"16b1c4e01c89ba07367461e0bc4cb84993c2d027\",\"lessThan\":\"58733b1dd46bb231d9d279c132a20ee46da1b664\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"16b1c4e01c89ba07367461e0bc4cb84993c2d027\",\"lessThan\":\"4039cd807a5a46dc5f7618fffae926b8ad8455eb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"16b1c4e01c89ba07367461e0bc4cb84993c2d027\",\"lessThan\":\"1f428e30947395d9b9aacee03e25a4e6cfcad7a4\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/usb/ax88179_178a.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.152\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.104\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1c63303659a2264bd55d9813df74cb4caeed5922\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/1f428e30947395d9b9aacee03e25a4e6cfcad7a4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2be5091fa693b9119ad25a8bb8c149d236a23ade\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4039cd807a5a46dc5f7618fffae926b8ad8455eb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/58733b1dd46bb231d9d279c132a20ee46da1b664\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/83a765cbd7b4d11b0b9fa1bb9d941ae911a2159b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-25T10:02:41+00:00",
      "cve": "CVE-2026-74678",
      "id": "CVE-2026-74678",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74678.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.