CVE-2026-74677

CVE CVE-2026-74677EUVD EUVD-2026-64364Published 2026-08-22T15:32:46.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: net: usb: ipheth: fix carrier_work UAF on disconnect ipheth_sndbulk_callback() re-arms the carrier-check work on any non-zero URB status: else schedule_delayed_work(&dev->carrier_work, 0); Nothing ties that to the interface being up, so the work can be armed again after ipheth_close() has already drained it, and stay armed until the netdev whose private area embeds it is freed. On unplug with a TX URB in flight, ipheth_disconnect() drains the work through unregister_netdev() -> ipheth_close() -> cancel_delayed_work_sync() and only then calls ipheth_kill_urbs(). usb_kill_urb() completes the in-flight TX URB with -ENOENT, so ipheth_sndbulk_callback() runs after the drain and re-arms carrier_work. The same completion also re-arms the work if the interface is only brought down while a TX URB is in flight, and ipheth_carrier_check_work() then keeps re-queueing itself once a second. unregister_netdev() does not call ipheth_close() for an already-down interface, so nothing drains it on the later unplug either. In both cases free_netdev() frees the netdev while carrier_work is still pending, and ipheth_carrier_check_work() dereferences freed memory. Tie the work to the interface state instead of chasing the completion: disable it in ipheth_close() and enable it in ipheth_open(), so a schedule_delayed_work() from the URB completion is a no-op whenever the interface is not up. disable_delayed_work_sync() also waits for a running instance, so it fully replaces the cancel_delayed_work_sync() it takes the place of. The work starts out disabled in ipheth_probe() so the enable/disable counts balance from the first open. Reproduced under KASAN on linux-next (next-20260731) with dummy_hcd and raw-gadget standing in for the device, driving the second path above (the interface is already down, so unregister_netdev() does not call ipheth_close()): 15 of 15 unpatched boots report a slab-use-after-free in __run_timers(), freed by ipheth_disconnect() and re-armed from ipheth_sndbulk_callback() via queue_delayed_work_on(). The same trigger on a kernel differing only by this patch reports 0 of 15, and the carrier check still functions across open/close cycles. The reproducer needs an attached USB device that stops draining bulk OUT, plus a link down and unplug, driven as root. It is not a privilege boundary crossing and no exploit primitive was developed. Found by 0sec (https://0sec.ai).

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux 4.15; 4f2df9fd07698bece3321fbf9e4b6dbcb9babccc; 4.9.173 <4.10; f5bca75dc46701f4c0d1dcbaae401233ae7ff06b; patch: 7.1.9; bb1b40c7cb863f0800a6410c7dcb86cf3f28d3b1 <48303f3ae0fa6e102f3fc7dbf1688cc179131962; 4.14.116 <4.15; bb1b40c7cb863f0800a6410c7dcb86cf3f28d3b1 <2c7496124e94c7f9c3daa5c5b1fb563ca9d62c45; bb1b40c7cb863f0800a6410c7dcb86cf3f28d3b1 <fde39b8a521780391fb4e5bda2c0aa4928947f12; patch: 0; bb1b40c7cb863f0800a6410c7dcb86cf3f28d3b1 <d07133fe1befae9a1e4c4c5e46ef0b73d2992020; 4.4.180 <4.5; patch: 7.2; patch: 6.12.104; patch: 6.18.45; ea7d6be58c2e6c1f426b48994bb22b2393c90963

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.