CVE-2026-74677 - Vulnerability Details

- net: usb: ipheth: fix carrier_work UAF on disconnect

Description

In the Linux kernel, the following vulnerability has been resolved:

net: usb: ipheth: fix carrier_work UAF on disconnect

ipheth_sndbulk_callback() re-arms the carrier-check work on any
non-zero URB status:

else
schedule_delayed_work(&dev->carrier_work, 0);

Nothing ties that to the interface being up, so the work can be armed
again after ipheth_close() has already drained it, and stay armed
until the netdev whose private area embeds it is freed.

On unplug with a TX URB in flight, ipheth_disconnect() drains the work
through unregister_netdev() -> ipheth_close() ->
cancel_delayed_work_sync() and only then calls ipheth_kill_urbs().
usb_kill_urb() completes the in-flight TX URB with -ENOENT, so
ipheth_sndbulk_callback() runs after the drain and re-arms
carrier_work.

The same completion also re-arms the work if the interface is only
brought down while a TX URB is in flight, and
ipheth_carrier_check_work() then keeps re-queueing itself once a
second. unregister_netdev() does not call ipheth_close() for an
already-down interface, so nothing drains it on the later unplug
either.

In both cases free_netdev() frees the netdev while carrier_work is
still pending, and ipheth_carrier_check_work() dereferences freed
memory.

Tie the work to the interface state instead of chasing the completion:
disable it in ipheth_close() and enable it in ipheth_open(), so a
schedule_delayed_work() from the URB completion is a no-op whenever
the interface is not up. disable_delayed_work_sync() also waits for a
running instance, so it fully replaces the cancel_delayed_work_sync()
it takes the place of. The work starts out disabled in ipheth_probe()
so the enable/disable counts balance from the first open.

Reproduced under KASAN on linux-next (next-20260731) with dummy_hcd and
raw-gadget standing in for the device, driving the second path above (the
interface is already down, so unregister_netdev() does not call
ipheth_close()): 15 of 15 unpatched boots report a slab-use-after-free in
__run_timers(), freed by ipheth_disconnect() and re-armed from
ipheth_sndbulk_callback() via queue_delayed_work_on(). The
same trigger on a kernel differing only by this patch reports 0 of 15,
and the carrier check still functions across open/close cycles.

The reproducer needs an attached USB device that stops draining bulk OUT,
plus a link down and unplug, driven as root. It is not a privilege
boundary crossing and no exploit primitive was developed.

Found by 0sec (https://0sec.ai).

Published: 2026-08-22

Score: 7.0 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A use‑after‑free in the Linux kernel ipheth USB driver occurs when a bulk OUT transfer is still in progress and the device is disconnected or the interface is brought down. The driver re‑arms a delayed work queue after a URB completion without verifying that the network device is still present; the work can execute after the netdev has been freed, dereferencing stale memory and potentially leading to kernel‑level memory corruption or a crash. The CVE description does not describe an exploit‑level primitive, and no exploit is currently known, but the flaw provides a kernel‑level memory corruption vector that could be leveraged if an attacker can control the USB device or its state.

Affected Systems

All Linux kernel versions that include the ipheth driver before the patch are affected. The vulnerability resides solely in the ipheth USB driver code; kernels that are compiled without this driver or do not use it are not impacted. The issue applies to any distribution that ships a Linux kernel with the standard ipheth driver enabled.

Risk and Exploitability

The CVSS score is 7.0, indicating moderate severity. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalogue. Extrapolating from the description, an attacker would need to control a USB device with a bulk OUT transfer in flight and manipulate the device’s disconnect sequence, which suggests a moderate to low likelihood of exploitation in the wild. Nevertheless, the impact is high: a successful use‑after‑free can crash the kernel or corrupt kernel memory, potentially allowing escalation of privileges or denial of service.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`bb1b40c7cb863f0800a6410c7dcb86cf3f28d3b1`	affected	< d07133fe1befae9a1e4c4c5e46ef0b73d2992020
`bb1b40c7cb863f0800a6410c7dcb86cf3f28d3b1`	affected	< 2c7496124e94c7f9c3daa5c5b1fb563ca9d62c45
`bb1b40c7cb863f0800a6410c7dcb86cf3f28d3b1`	affected	< 48303f3ae0fa6e102f3fc7dbf1688cc179131962
`bb1b40c7cb863f0800a6410c7dcb86cf3f28d3b1`	affected	< fde39b8a521780391fb4e5bda2c0aa4928947f12
`4f2df9fd07698bece3321fbf9e4b6dbcb9babccc`	affected	—
`ea7d6be58c2e6c1f426b48994bb22b2393c90963`	affected	—
`f5bca75dc46701f4c0d1dcbaae401233ae7ff06b`	affected	—
`4.4.180`	affected	< 4.5
`4.9.173`	affected	< 4.10
`4.14.116`	affected	< 4.15

Linux

affected

Version	Status	Constraints
`4.15`	affected	—
`0`	unaffected	< 4.15
`6.12.104`	unaffected	≤ 6.12.*
`6.18.45`	unaffected	≤ 6.18.*
`7.1.9`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[bb1b40c7cb863f0800a6410c7dcb86cf3f28d3b1,d07133fe1befae9a1e4c4c5e46ef0b73d2992020)`	affected	code_commit	—
`[bb1b40c7cb863f0800a6410c7dcb86cf3f28d3b1,2c7496124e94c7f9c3daa5c5b1fb563ca9d62c45)`	affected	code_commit	—
`[bb1b40c7cb863f0800a6410c7dcb86cf3f28d3b1,48303f3ae0fa6e102f3fc7dbf1688cc179131962)`	affected	code_commit	—
`[bb1b40c7cb863f0800a6410c7dcb86cf3f28d3b1,fde39b8a521780391fb4e5bda2c0aa4928947f12)`	affected	code_commit	—
`4f2df9fd07698bece3321fbf9e4b6dbcb9babccc`	affected	code_commit	—
`ea7d6be58c2e6c1f426b48994bb22b2393c90963`	affected	code_commit	—
`f5bca75dc46701f4c0d1dcbaae401233ae7ff06b`	affected	code_commit	—
`[4.4.180,4.5)`	affected	semver	—
`[4.9.173,4.10)`	affected	semver	—
`[4.14.116,4.15)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.15`	affected	generic	—
`[0,4.15)`	unaffected	generic	—
`[6.12.104,6.13.0)`	unaffected	semver	—
`[6.18.45,6.19.0)`	unaffected	semver	—
`[7.1.9,7.2.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the ipheth driver patch that disables the carrier_work on close and prevents re‑arming after disconnect
If an upgrade is not possible, disable or unload the ipheth driver: remove the module or block the USB composite driver implementing ipheth to eliminate the vulnerable code path
Reboot the system after applying the patch or disabling the driver to ensure all delayed work queues and network device structures are cleared

Generated by OpenCVE AI on August 24, 2026 at 19:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6466-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00168.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2c7496124e94c7f9c3daa5c5b1fb563ca9d62c45
https://git.kernel.org/stable/c/48303f3ae0fa6e102f3fc7dbf1688cc179131962
https://git.kernel.org/stable/c/d07133fe1befae9a1e4c4c5e46ef0b73d2992020
https://git.kernel.org/stable/c/fde39b8a521780391fb4e5bda2c0aa4928947f12
https://lore.kernel.org/linux-cve-announce/2026082231-CVE-2026-74677-ecca@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74677
https://www.cve.org/CVERecord?id=CVE-2026-74677

History

Mon, 24 Aug 2026 15:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Mon, 24 Aug 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026082231-CVE-2026-74677-ecca@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74677 https://www.cve.org/CVERecord?id=CVE-2026-74677
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Sat, 22 Aug 2026 19:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sat, 22 Aug 2026 15:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: usb: ipheth: fix carrier_work UAF on disconnect ipheth_sndbulk_callback() re-arms the carrier-check work on any non-zero URB status: else schedule_delayed_work(&dev->carrier_work, 0); Nothing ties that to the interface being up, so the work can be armed again after ipheth_close() has already drained it, and stay armed until the netdev whose private area embeds it is freed. On unplug with a TX URB in flight, ipheth_disconnect() drains the work through unregister_netdev() -> ipheth_close() -> cancel_delayed_work_sync() and only then calls ipheth_kill_urbs(). usb_kill_urb() completes the in-flight TX URB with -ENOENT, so ipheth_sndbulk_callback() runs after the drain and re-arms carrier_work. The same completion also re-arms the work if the interface is only brought down while a TX URB is in flight, and ipheth_carrier_check_work() then keeps re-queueing itself once a second. unregister_netdev() does not call ipheth_close() for an already-down interface, so nothing drains it on the later unplug either. In both cases free_netdev() frees the netdev while carrier_work is still pending, and ipheth_carrier_check_work() dereferences freed memory. Tie the work to the interface state instead of chasing the completion: disable it in ipheth_close() and enable it in ipheth_open(), so a schedule_delayed_work() from the URB completion is a no-op whenever the interface is not up. disable_delayed_work_sync() also waits for a running instance, so it fully replaces the cancel_delayed_work_sync() it takes the place of. The work starts out disabled in ipheth_probe() so the enable/disable counts balance from the first open. Reproduced under KASAN on linux-next (next-20260731) with dummy_hcd and raw-gadget standing in for the device, driving the second path above (the interface is already down, so unregister_netdev() does not call ipheth_close()): 15 of 15 unpatched boots report a slab-use-after-free in __run_timers(), freed by ipheth_disconnect() and re-armed from ipheth_sndbulk_callback() via queue_delayed_work_on(). The same trigger on a kernel differing only by this patch reports 0 of 15, and the carrier check still functions across open/close cycles. The reproducer needs an attached USB device that stops draining bulk OUT, plus a link down and unplug, driven as root. It is not a privilege boundary crossing and no exploit primitive was developed. Found by 0sec (https://0sec.ai).
Title		net: usb: ipheth: fix carrier_work UAF on disconnect
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2c7496124e94c7f9c3daa5c5b1fb563ca9d62c45 https://git.kernel.org/stable/c/48303f3ae0fa6e102f3fc7dbf1688cc179131962 https://git.kernel.org/stable/c/d07133fe1befae9a1e4c4c5e46ef0b73d2992020 https://git.kernel.org/stable/c/fde39b8a521780391fb4e5bda2c0aa4928947f12

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-22T15:32:46.001Z

Updated: 2026-08-22T15:32:46.001Z

Reserved: 2026-08-15T05:44:03.925Z

Link: CVE-2026-74677

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-22T16:16:41.847

Modified: 2026-08-22T16:16:41.847

Link: CVE-2026-74677

Redhat

Severity : Moderate

Publid Date: 2026-08-22T00:00:00Z

Links: CVE-2026-74677 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-24T20:00:04Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object