CVE-2026-74680 - Vulnerability Details

- usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()

If cxacru_cm() encounters an error while submitting or waiting for snd_urb,
it aborts and returns the error without killing the already submitted
rcv_urb. This leaves the rcv_urb active.

When this happens during initialization (e.g., in cxacru_atm_start()), the
driver may ignore the error and proceed to call cxacru_poll_status(), which
invokes cxacru_cm() again. Attempting to submit the still-active rcv_urb
triggers a warning in usb_submit_urb():

cxacru 1-1:1.0: send of cm 0x84 failed (-104)
ATM dev 0: cxacru_atm_start: CHIP_ADSL_LINE_START returned -104
------------[ cut here ]------------
URB ffff88812658d200 submitted while active
WARNING: drivers/usb/core/urb.c:379 at usb_submit_urb+0x79/0x18b0
drivers/usb/core/urb.c:379
...
Call Trace:
<TASK>
cxacru_cm+0x21a/0xf10 drivers/usb/atm/cxacru.c:631
cxacru_cm_get_array drivers/usb/atm/cxacru.c:722 [inline]
cxacru_poll_status+0x178/0x1110 drivers/usb/atm/cxacru.c:828
cxacru_atm_start+0x185/0x360 drivers/usb/atm/cxacru.c:814
usbatm_atm_init+0x144/0x3a0 drivers/usb/atm/usbatm.c:927
usbatm_usb_probe+0x15cb/0x1db0 drivers/usb/atm/usbatm.c:1178
cxacru_usb_probe+0x17f/0x220 drivers/usb/atm/cxacru.c:1370
...

To fix this, ensure that rcv_urb is properly killed if cxacru_cm() aborts
early. We can safely call usb_kill_urb() on rcv_urb in the error path, as
it is safe to call even if the URB is not active (e.g., if it failed to
submit in the first place, or if it already completed).

Published: 2026-08-22

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The cxacru_cm() routine in the Linux USB ATM driver fails to terminate the receive USB request block (rcv_urb) when an error occurs during submission or waiting for the send request (snd_urb). The rcv_urb remains active and over time may be re‑submitted during initialization, which triggers a warning in usb_submit_urb() and could lead to kernel instability or a crash if the faulty URB is repeatedly processed. This flaw represents an improper resource cleanup that can leave the driver in an inconsistent state.

Affected Systems

All kernel installations that include the cxacru USB ATM driver before the fix are potentially affected. The issue is present in any Linux kernel version that ships the unpatched driver module, regardless of distribution or kernel flavor.

Risk and Exploitability

The CVSS score is 5.5 and the EPSS score is less than 1%, indicating a moderate severity and a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack would require local or physical access to the system hosting a USB ATM device, as the flaw is triggered during driver initialization of the device.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1b0e614652344a2d39eb336f3dc07651782883bf`	affected	< 6133b461058316e3ccba7331f974d110d4c08b23
`1b0e614652344a2d39eb336f3dc07651782883bf`	affected	< 61093d7f1144f6a15bac505df35e5f535ade2ac1
`1b0e614652344a2d39eb336f3dc07651782883bf`	affected	< 645d98dbccdbfdbf0129f48822af7183492de091
`1b0e614652344a2d39eb336f3dc07651782883bf`	affected	< 993f7677949e3d72e360e86eed1f41c2511f75ed
`1b0e614652344a2d39eb336f3dc07651782883bf`	affected	< 939b6a41f681aea52af678053072ee443068e93e
`1b0e614652344a2d39eb336f3dc07651782883bf`	affected	< 2f73a065791d2a8e3f0bdf29248e33600359e865
`1b0e614652344a2d39eb336f3dc07651782883bf`	affected	< 0af047703dbed8224552587ed436f14a24371b46
`1b0e614652344a2d39eb336f3dc07651782883bf`	affected	< c2f811314be351d86b6ab41e9297ae80d8da6f86

Linux

affected

Version	Status	Constraints
`2.6.13`	affected	—
`0`	unaffected	< 2.6.13
`5.10.265`	unaffected	≤ 5.10.*
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.152`	unaffected	≤ 6.6.*
`6.12.104`	unaffected	≤ 6.12.*
`6.18.45`	unaffected	≤ 6.18.*
`7.1.9`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1b0e614652344a2d39eb336f3dc07651782883bf,6133b461058316e3ccba7331f974d110d4c08b23)`	affected	code_commit	—
`[1b0e614652344a2d39eb336f3dc07651782883bf,61093d7f1144f6a15bac505df35e5f535ade2ac1)`	affected	code_commit	—
`[1b0e614652344a2d39eb336f3dc07651782883bf,645d98dbccdbfdbf0129f48822af7183492de091)`	affected	code_commit	—
`[1b0e614652344a2d39eb336f3dc07651782883bf,993f7677949e3d72e360e86eed1f41c2511f75ed)`	affected	code_commit	—
`[1b0e614652344a2d39eb336f3dc07651782883bf,939b6a41f681aea52af678053072ee443068e93e)`	affected	code_commit	—
`[1b0e614652344a2d39eb336f3dc07651782883bf,2f73a065791d2a8e3f0bdf29248e33600359e865)`	affected	code_commit	—
`[1b0e614652344a2d39eb336f3dc07651782883bf,0af047703dbed8224552587ed436f14a24371b46)`	affected	code_commit	—
`[1b0e614652344a2d39eb336f3dc07651782883bf,c2f811314be351d86b6ab41e9297ae80d8da6f86)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.13`	affected	semver	—
`[0,2.6.13)`	unaffected	semver	—
`[5.10.265,5.11.0)`	unaffected	semver	—
`[5.15.216,5.16.0)`	unaffected	semver	—
`[6.1.183,6.2.0)`	unaffected	semver	—
`[6.6.152,6.7.0)`	unaffected	semver	—
`[6.12.104,6.13.0)`	unaffected	semver	—
`[6.18.45,6.19.0)`	unaffected	semver	—
`[7.1.9,7.2.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a release that includes the cxacru driver patch that removes an active rcv_urb on error. Verify the new kernel version through the distribution’s patch notes or the vendor’s maintenance bulletin.
If the kernel cannot be updated immediately, blacklist or unload the cxacru module or otherwise block enumeration of the offending USB ATM device to prevent re‑initialization of the faulty URB.
After applying the patch or disabling the driver, restart the system or unload and reload the module so that any residual active URBs are cleared and the kernel returns to a stable state.

Generated by OpenCVE AI on August 25, 2026 at 17:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update
Debian DSA	DSA-6466-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00177.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0af047703dbed8224552587ed436f14a24371b46
https://git.kernel.org/stable/c/2f73a065791d2a8e3f0bdf29248e33600359e865
https://git.kernel.org/stable/c/61093d7f1144f6a15bac505df35e5f535ade2ac1
https://git.kernel.org/stable/c/6133b461058316e3ccba7331f974d110d4c08b23
https://git.kernel.org/stable/c/645d98dbccdbfdbf0129f48822af7183492de091
https://git.kernel.org/stable/c/939b6a41f681aea52af678053072ee443068e93e
https://git.kernel.org/stable/c/993f7677949e3d72e360e86eed1f41c2511f75ed
https://git.kernel.org/stable/c/c2f811314be351d86b6ab41e9297ae80d8da6f86
https://lore.kernel.org/linux-cve-announce/2026082231-CVE-2026-74680-526a@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74680
https://www.cve.org/CVERecord?id=CVE-2026-74680

History

Tue, 25 Aug 2026 15:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-401

Tue, 25 Aug 2026 12:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026082231-CVE-2026-74680-526a@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74680 https://www.cve.org/CVERecord?id=CVE-2026-74680
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Sat, 22 Aug 2026 18:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-401 CWE-772

Sat, 22 Aug 2026 15:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() If cxacru_cm() encounters an error while submitting or waiting for snd_urb, it aborts and returns the error without killing the already submitted rcv_urb. This leaves the rcv_urb active. When this happens during initialization (e.g., in cxacru_atm_start()), the driver may ignore the error and proceed to call cxacru_poll_status(), which invokes cxacru_cm() again. Attempting to submit the still-active rcv_urb triggers a warning in usb_submit_urb(): cxacru 1-1:1.0: send of cm 0x84 failed (-104) ATM dev 0: cxacru_atm_start: CHIP_ADSL_LINE_START returned -104 ------------[ cut here ]------------ URB ffff88812658d200 submitted while active WARNING: drivers/usb/core/urb.c:379 at usb_submit_urb+0x79/0x18b0 drivers/usb/core/urb.c:379 ... Call Trace: <TASK> cxacru_cm+0x21a/0xf10 drivers/usb/atm/cxacru.c:631 cxacru_cm_get_array drivers/usb/atm/cxacru.c:722 [inline] cxacru_poll_status+0x178/0x1110 drivers/usb/atm/cxacru.c:828 cxacru_atm_start+0x185/0x360 drivers/usb/atm/cxacru.c:814 usbatm_atm_init+0x144/0x3a0 drivers/usb/atm/usbatm.c:927 usbatm_usb_probe+0x15cb/0x1db0 drivers/usb/atm/usbatm.c:1178 cxacru_usb_probe+0x17f/0x220 drivers/usb/atm/cxacru.c:1370 ... To fix this, ensure that rcv_urb is properly killed if cxacru_cm() aborts early. We can safely call usb_kill_urb() on rcv_urb in the error path, as it is safe to call even if the URB is not active (e.g., if it failed to submit in the first place, or if it already completed).
Title		usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0af047703dbed8224552587ed436f14a24371b46 https://git.kernel.org/stable/c/2f73a065791d2a8e3f0bdf29248e33600359e865 https://git.kernel.org/stable/c/61093d7f1144f6a15bac505df35e5f535ade2ac1 https://git.kernel.org/stable/c/6133b461058316e3ccba7331f974d110d4c08b23 https://git.kernel.org/stable/c/645d98dbccdbfdbf0129f48822af7183492de091 https://git.kernel.org/stable/c/939b6a41f681aea52af678053072ee443068e93e https://git.kernel.org/stable/c/993f7677949e3d72e360e86eed1f41c2511f75ed https://git.kernel.org/stable/c/c2f811314be351d86b6ab41e9297ae80d8da6f86

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-22T15:32:48.230Z

Updated: 2026-08-22T15:32:48.230Z

Reserved: 2026-08-15T05:44:03.925Z

Link: CVE-2026-74680

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-22T16:16:42.227

Modified: 2026-08-22T16:16:42.227

Link: CVE-2026-74680

Redhat

Severity : Low

Publid Date: 2026-08-22T00:00:00Z

Links: CVE-2026-74680 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-25T18:00:15Z

Weaknesses

CWE-772
Missing Release of Resource after Effective Lifetime

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object