SB20260824101 - Use-after-free in Linux kernel net usb driver

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-74677)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ipheth carrier_work logic in drivers/net/usb/ipheth.c when handling USB disconnect and TX URB completion events. A local user can trigger link down and unplug conditions while a TX URB is in flight to cause a denial of service.

Exploitation requires an attached USB device that stops draining bulk OUT, and the described reproducer was driven as root.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2c7496124e94c7f9c3daa5c5b1fb563ca9d62c45
• https://git.kernel.org/stable/c/48303f3ae0fa6e102f3fc7dbf1688cc179131962
• https://git.kernel.org/stable/c/d07133fe1befae9a1e4c4c5e46ef0b73d2992020
• https://git.kernel.org/stable/c/fde39b8a521780391fb4e5bda2c0aa4928947f12