The flaw lies in the kaweth USB network driver of the Linux kernel. The ndo_set_rx_mode callback, implemented by kaweth_set_rx_mode(), inappropriately calls netif_wake_queue() while a transmit USB Transfer Request Block (URB) is still active. This race condition allows a second usb_submit_urb() on the same URB, triggering the kernel WARN "URB submitted while active". Repeatedly invoking this routine can lead to kernel instability or crashes. The defect illustrates a concurrency race condition that can compromise system reliability.

All Linux kernel images that include the kaweth driver before the commit that removed netif_wake_queue from kaweth_set_rx_mode are affected. Distribution kernels built from sources prior to the change exhibit the vulnerability. The precise kernel release numbers are not specified in the advisory, so any system running a pre‑patch kaweth driver on a USB Ethernet device is at risk.

The vulnerability requires an attacker to trigger a multicast configuration change that calls kaweth_set_rx_mode(). Based on the description, it is inferred that the likely attack vector is local; an attacker would need kernel or root privileges, or an application with the ability to alter network interface settings, to execute the fault. The CVSS score of 7.8 indicates high severity. The EPSS score is < 1%, indicating a very low exploitation probability, and the vulnerability is not listed in CISA KEV. Nevertheless, the recurrent WARNs can accumulate and destabilize the system, warranting prompt remediation.