CVE-2026-74680
Received Received - Intake

USB URB Use-After-Free in Linux Kernel cxacru Driver

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() If cxacru_cm() encounters an error while submitting or waiting for snd_urb, it aborts and returns the error without killing the already submitted rcv_urb. This leaves the rcv_urb active. When this happens during initialization (e.g., in cxacru_atm_start()), the driver may ignore the error and proceed to call cxacru_poll_status(), which invokes cxacru_cm() again. Attempting to submit the still-active rcv_urb triggers a warning in usb_submit_urb(): cxacru 1-1:1.0: send of cm 0x84 failed (-104) ATM dev 0: cxacru_atm_start: CHIP_ADSL_LINE_START returned -104 ------------[ cut here ]------------ URB ffff88812658d200 submitted while active WARNING: drivers/usb/core/urb.c:379 at usb_submit_urb+0x79/0x18b0 drivers/usb/core/urb.c:379 ... Call Trace: <TASK> cxacru_cm+0x21a/0xf10 drivers/usb/atm/cxacru.c:631 cxacru_cm_get_array drivers/usb/atm/cxacru.c:722 [inline] cxacru_poll_status+0x178/0x1110 drivers/usb/atm/cxacru.c:828 cxacru_atm_start+0x185/0x360 drivers/usb/atm/cxacru.c:814 usbatm_atm_init+0x144/0x3a0 drivers/usb/atm/usbatm.c:927 usbatm_usb_probe+0x15cb/0x1db0 drivers/usb/atm/usbatm.c:1178 cxacru_usb_probe+0x17f/0x220 drivers/usb/atm/cxacru.c:1370 ... To fix this, ensure that rcv_urb is properly killed if cxacru_cm() aborts early. We can safely call usb_kill_urb() on rcv_urb in the error path, as it is safe to call even if the URB is not active (e.g., if it failed to submit in the first place, or if it already completed).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74680
EUVD
EUVD-2026-64367

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the USB ATM driver for cxacru devices. When an error occurs during initialization, the driver fails to properly terminate an active USB receive request (rcv_urb). This leaves the request running while the system attempts to reuse it, causing a kernel warning and potential system instability.

Detection Guidance

This vulnerability may trigger kernel warnings when the cxacru USB ATM driver encounters errors during initialization. Check system logs for messages like 'URB submitted while active' or 'send of cm 0x84 failed (-104)' using commands like 'dmesg | grep cxacru' or 'journalctl -k | grep cxacru'.

Impact Analysis

This could cause system instability or crashes when using certain USB ATM devices. The kernel warning indicates a resource conflict, which may lead to unexpected behavior or require a reboot to resolve.

Mitigation Strategies

Apply the Linux kernel patch that fixes the improper handling of rcv_urb in cxacru_cm(). Update to a kernel version containing the fix. If immediate patching isn't possible, consider disabling the cxacru driver module to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74680. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart