FKIE_CVE-2026-74677

Vulnerability from fkie_nvd - Published: 2026-08-22 16:16 - Updated: 2026-10-14 13:10
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: net: usb: ipheth: fix carrier_work UAF on disconnect ipheth_sndbulk_callback() re-arms the carrier-check work on any non-zero URB status: else schedule_delayed_work(&dev->carrier_work, 0); Nothing ties that to the interface being up, so the work can be armed again after ipheth_close() has already drained it, and stay armed until the netdev whose private area embeds it is freed. On unplug with a TX URB in flight, ipheth_disconnect() drains the work through unregister_netdev() -> ipheth_close() -> cancel_delayed_work_sync() and only then calls ipheth_kill_urbs(). usb_kill_urb() completes the in-flight TX URB with -ENOENT, so ipheth_sndbulk_callback() runs after the drain and re-arms carrier_work. The same completion also re-arms the work if the interface is only brought down while a TX URB is in flight, and ipheth_carrier_check_work() then keeps re-queueing itself once a second. unregister_netdev() does not call ipheth_close() for an already-down interface, so nothing drains it on the later unplug either. In both cases free_netdev() frees the netdev while carrier_work is still pending, and ipheth_carrier_check_work() dereferences freed memory. Tie the work to the interface state instead of chasing the completion: disable it in ipheth_close() and enable it in ipheth_open(), so a schedule_delayed_work() from the URB completion is a no-op whenever the interface is not up. disable_delayed_work_sync() also waits for a running instance, so it fully replaces the cancel_delayed_work_sync() it takes the place of. The work starts out disabled in ipheth_probe() so the enable/disable counts balance from the first open. Reproduced under KASAN on linux-next (next-20260731) with dummy_hcd and raw-gadget standing in for the device, driving the second path above (the interface is already down, so unregister_netdev() does not call ipheth_close()): 15 of 15 unpatched boots report a slab-use-after-free in __run_timers(), freed by ipheth_disconnect() and re-armed from ipheth_sndbulk_callback() via queue_delayed_work_on(). The same trigger on a kernel differing only by this patch reports 0 of 15, and the carrier check still functions across open/close cycles. The reproducer needs an attached USB device that stops draining bulk OUT, plus a link down and unplug, driven as root. It is not a privilege boundary crossing and no exploit primitive was developed. Found by 0sec (https://0sec.ai).
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2c7496124e94c7f9c3daa5c5b1fb563ca9d62c45
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/48303f3ae0fa6e102f3fc7dbf1688cc179131962
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d07133fe1befae9a1e4c4c5e46ef0b73d2992020
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/fde39b8a521780391fb4e5bda2c0aa4928947f12
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/usb/ipheth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d07133fe1befae9a1e4c4c5e46ef0b73d2992020",
              "status": "affected",
              "version": "bb1b40c7cb863f0800a6410c7dcb86cf3f28d3b1",
              "versionType": "git"
            },
            {
              "lessThan": "2c7496124e94c7f9c3daa5c5b1fb563ca9d62c45",
              "status": "affected",
              "version": "bb1b40c7cb863f0800a6410c7dcb86cf3f28d3b1",
              "versionType": "git"
            },
            {
              "lessThan": "48303f3ae0fa6e102f3fc7dbf1688cc179131962",
              "status": "affected",
              "version": "bb1b40c7cb863f0800a6410c7dcb86cf3f28d3b1",
              "versionType": "git"
            },
            {
              "lessThan": "fde39b8a521780391fb4e5bda2c0aa4928947f12",
              "status": "affected",
              "version": "bb1b40c7cb863f0800a6410c7dcb86cf3f28d3b1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4f2df9fd07698bece3321fbf9e4b6dbcb9babccc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ea7d6be58c2e6c1f426b48994bb22b2393c90963",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f5bca75dc46701f4c0d1dcbaae401233ae7ff06b",
              "versionType": "git"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.180",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.173",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.116",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/usb/ipheth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: ipheth: fix carrier_work UAF on disconnect\n\nipheth_sndbulk_callback() re-arms the carrier-check work on any\nnon-zero URB status:\n\n\telse\n\t\tschedule_delayed_work(\u0026dev-\u003ecarrier_work, 0);\n\nNothing ties that to the interface being up, so the work can be armed\nagain after ipheth_close() has already drained it, and stay armed\nuntil the netdev whose private area embeds it is freed.\n\nOn unplug with a TX URB in flight, ipheth_disconnect() drains the work\nthrough unregister_netdev() -\u003e ipheth_close() -\u003e\ncancel_delayed_work_sync() and only then calls ipheth_kill_urbs().\nusb_kill_urb() completes the in-flight TX URB with -ENOENT, so\nipheth_sndbulk_callback() runs after the drain and re-arms\ncarrier_work.\n\nThe same completion also re-arms the work if the interface is only\nbrought down while a TX URB is in flight, and\nipheth_carrier_check_work() then keeps re-queueing itself once a\nsecond. unregister_netdev() does not call ipheth_close() for an\nalready-down interface, so nothing drains it on the later unplug\neither.\n\nIn both cases free_netdev() frees the netdev while carrier_work is\nstill pending, and ipheth_carrier_check_work() dereferences freed\nmemory.\n\nTie the work to the interface state instead of chasing the completion:\ndisable it in ipheth_close() and enable it in ipheth_open(), so a\nschedule_delayed_work() from the URB completion is a no-op whenever\nthe interface is not up. disable_delayed_work_sync() also waits for a\nrunning instance, so it fully replaces the cancel_delayed_work_sync()\nit takes the place of. The work starts out disabled in ipheth_probe()\nso the enable/disable counts balance from the first open.\n\nReproduced under KASAN on linux-next (next-20260731) with dummy_hcd and\nraw-gadget standing in for the device, driving the second path above (the\ninterface is already down, so unregister_netdev() does not call\nipheth_close()): 15 of 15 unpatched boots report a slab-use-after-free in\n__run_timers(), freed by ipheth_disconnect() and re-armed from\nipheth_sndbulk_callback() via queue_delayed_work_on(). The\nsame trigger on a kernel differing only by this patch reports 0 of 15,\nand the carrier check still functions across open/close cycles.\n\nThe reproducer needs an attached USB device that stops draining bulk OUT,\nplus a link down and unplug, driven as root. It is not a privilege\nboundary crossing and no exploit primitive was developed.\n\nFound by 0sec (https://0sec.ai)."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: usb: ipheth: corregir uso despu\u00e9s de liberaci\u00f3n de carrier_work al desconectar\n\nipheth_sndbulk_callback() re-arma el trabajo de verificaci\u00f3n de portadora en cualquier estado URB distinto de cero:\n\n\telse\n\t\tschedule_delayed_work(\u0026dev -\u003e carrier_work, 0);\n\nNada vincula eso a que la interfaz est\u00e9 activa, por lo que el trabajo puede ser re-armado de nuevo despu\u00e9s de que ipheth_close() ya lo haya vaciado, y permanecer activado hasta que se libere el netdev cuya \u00e1rea privada lo incrusta.\n\nAl desconectar con un URB de TX en curso, ipheth_disconnect() vac\u00eda el trabajo a trav\u00e9s de unregister_netdev()  -\u003e  ipheth_close()  -\u003e  cancel_delayed_work_sync() y solo entonces llama a ipheth_kill_urbs(). usb_kill_urb() completa el URB de TX en curso con -ENOENT, por lo que ipheth_sndbulk_callback() se ejecuta despu\u00e9s del vaciado y re-arma carrier_work.\n\nLa misma finalizaci\u00f3n tambi\u00e9n re-arma el trabajo si la interfaz solo se desactiva mientras un URB de TX est\u00e1 en curso, e ipheth_carrier_check_work() luego sigue re-encol\u00e1ndose una vez por segundo. unregister_netdev() no llama a ipheth_close() para una interfaz ya inactiva, por lo que nada lo vac\u00eda en la desconexi\u00f3n posterior tampoco.\n\nEn ambos casos free_netdev() libera el netdev mientras carrier_work a\u00fan est\u00e1 pendiente, e ipheth_carrier_check_work() desreferencia memoria liberada.\n\nVincular el trabajo al estado de la interfaz en lugar de perseguir la finalizaci\u00f3n: desactivarlo en ipheth_close() y activarlo en ipheth_open(), para que un schedule_delayed_work() de la finalizaci\u00f3n del URB sea una operaci\u00f3n nula siempre que la interfaz no est\u00e9 activa. disable_delayed_work_sync() tambi\u00e9n espera una instancia en ejecuci\u00f3n, por lo que reemplaza completamente a cancel_delayed_work_sync() al que sustituye. El trabajo comienza desactivado en ipheth_probe() para que los recuentos de activaci\u00f3n/desactivaci\u00f3n se equilibren desde la primera apertura.\n\nReproducido bajo KASAN en linux-next (next-20260731) con dummy_hcd y raw-gadget sustituyendo al dispositivo, impulsando la segunda ruta anterior (la interfaz ya est\u00e1 inactiva, por lo que unregister_netdev() no llama a ipheth_close()): 15 de 15 arranques sin parchear informan de un uso despu\u00e9s de liberaci\u00f3n de slab en __run_timers(), liberado por ipheth_disconnect() y re-armado desde ipheth_sndbulk_callback() a trav\u00e9s de queue_delayed_work_on(). El mismo disparador en un kernel que difiere solo por este parche informa 0 de 15, y la verificaci\u00f3n de portadora sigue funcionando a trav\u00e9s de ciclos de apertura/cierre.\n\nEl reproductor necesita un dispositivo USB conectado que deja de vaciar bulk OUT, adem\u00e1s de un enlace ca\u00eddo y una desconexi\u00f3n, ejecutado como root. No es un cruce de l\u00edmites de privilegio y no se desarroll\u00f3 ning\u00fan primitivo de exploit.\n\nEncontrado por 0sec (https://0sec.ai)."
    }
  ],
  "id": "CVE-2026-74677",
  "lastModified": "2026-10-14T13:10:00.187",
  "metrics": {},
  "published": "2026-08-22T16:16:41.847",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/2c7496124e94c7f9c3daa5c5b1fb563ca9d62c45"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/48303f3ae0fa6e102f3fc7dbf1688cc179131962"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d07133fe1befae9a1e4c4c5e46ef0b73d2992020"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/fde39b8a521780391fb4e5bda2c0aa4928947f12"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.