CVE-2026-63874
Received Received - Intake

Race Condition in Linux Kernel MCTP USB Driver

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: mctp: usb: fix race between urb completion and rx_retry cancellation It's possible that sequencing between setting ->stopped and cancelling the rx_retry work (in ndo_stop) could leave us with an urb queued: T1: ndo_stop T2: rx_retry_work ------------ ---------------- LD: ->stopped => false ST: ->stopped <= true usb_kill_urb() mctp_usb_rx_queue() usb_submit_urb() cancel_delayed_work_sync() That urb completion can then re-schedule rx_retry_work. Strenghen the sequencing between the stop (preventing another requeue) and the cancel by updating both atomically under a new rx lock. After setting ->rx_stopped, and cancelling pending work, we know that the requeue cannot occur, so all that's left is killing any pending urb.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63874
EUVD
EUVD-2026-45559

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in the MCTP (Management Component Transport Protocol) USB driver. It occurs when the stop sequence and retry cancellation are not properly synchronized, potentially leaving a USB request block (URB) queued. This can lead to the retry work being rescheduled even after the device is stopped.

Detection Guidance

This vulnerability is specific to the Linux kernel's MCTP USB driver and may not have direct detection commands. Monitor kernel logs for errors related to mctp_usb or usb_submit_urb failures. Check for unusual network device behavior or USB device disconnections during high load.

Impact Analysis

This vulnerability could cause system instability or unexpected behavior in systems using MCTP over USB. It may lead to resource leaks, crashes, or improper device shutdowns if exploited or triggered under specific timing conditions.

Compliance Impact

This vulnerability affects network subsystem integrity in the Linux kernel, specifically related to USB-based MCTP (Management Component Transport Protocol) communication. It does not directly impact data privacy, security controls, or compliance with standards like GDPR or HIPAA, as it involves a race condition in urb (USB Request Block) handling rather than unauthorized data access or exposure.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for CVE-2026-63874. If immediate patching is not possible, consider disabling the MCTP USB driver if not in use or monitor for related errors in system logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63874. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart