In the Linux kernel, the following vulnerability has been resolved:
net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb
The syzbot fuzzer identified a problem in the usbnet driver:
usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 754 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 Modules linked in: CPU: 0 PID: 754 Comm: kworker/0:2 Not tainted 6.4.0-rc7-syzkaller-00014-g692b7dc87ca6 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 Workqueue: mld mld_ifc_work RIP: 0010:usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 Code: 7c 24 18 e8 2c b4 5b fb 48 8b 7c 24 18 e8 42 07 f0 fe 41 89 d8 44 89 e1 4c 89 ea 48 89 c6 48 c7 c7 a0 c9 fc 8a e8 5a 6f 23 fb <0f> 0b e9 58 f8 ff ff e8 fe b3 5b fb 48 81 c5 c0 05 00 00 e9 84 f7 RSP: 0018:ffffc9000463f568 EFLAGS: 00010086 RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 RDX: ffff88801eb28000 RSI: ffffffff814c03b7 RDI: 0000000000000001 RBP: ffff8881443b7190 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000003 R13: ffff88802a77cb18 R14: 0000000000000003 R15: ffff888018262500 FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000556a99c15a18 CR3: 0000000028c71000 CR4: 0000000000350ef0 Call Trace: <TASK> usbnet_start_xmit+0xfe5/0x2190 drivers/net/usb/usbnet.c:1453 __netdev_start_xmit include/linux/netdevice.h:4918 [inline] netdev_start_xmit include/linux/netdevice.h:4932 [inline] xmit_one net/core/dev.c:3578 [inline] dev_hard_start_xmit+0x187/0x700 net/core/dev.c:3594 ...
This bug is caused by the fact that usbnet trusts the bulk endpoint addresses its probe routine receives in the driver_info structure, and it does not check to see that these endpoints actually exist and have the expected type and directions.
The fix is simply to add such a check.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade bpftool-debuginfoUpgrade kernel-develUpgrade perf-debuginfoUpgrade python-perfUpgrade kernel-debuginfoUpgrade python-perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade perfUpgrade kernel-tools-debuginfoUpgrade kernel-headersUpgrade kernelUpgrade kernel-toolsUpgrade kernel-livepatch-4.14.322-244.536Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-develUpgrade bpftoolUpgrade kernel-livepatch-5.10.192-182.736 | May 20, 2026 | May 20, 2026 |
| Debian | — | Upgrade linux | Oct 6, 2025 | Oct 6, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade python3-perfUpgrade kernel-tools | Jan 15, 2026 | Jan 13, 2026 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade bpftoolUpgrade python3-perf | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernelUpgrade bpftoolUpgrade python3-perfUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernel-abi-stablelists | Feb 3, 2026 | Jan 30, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Oct 4, 2025 |
| Ubuntu | — | Upgrade linux-ibm-5.4Upgrade linux-gcpUpgrade linux-oracle-5.4Upgrade linux-bluefieldUpgrade linux-gkeUpgrade linux-ibm-5.15Upgrade linux-awsUpgrade linuxUpgrade linux-nvidia-tegra-5.15Upgrade linux-lowlatency-hwe-5.15Upgrade linux-intel-iot-realtimeUpgrade linux-aws-5.15Upgrade linux-raspi-5.4Upgrade linux-aws-5.4Upgrade linux-raspiUpgrade linux-nvidia-tegraUpgrade linux-azure-fipsUpgrade linux-xilinx-zynqmpUpgrade linux-gcp-fipsUpgrade linux-intel-iotgUpgrade linux-azureUpgrade linux-kvmUpgrade linux-gkeopUpgrade linux-riscv-5.15Upgrade linux-gcp-5.15Upgrade linux-hwe-5.15Upgrade linux-hwe-5.4Upgrade linux-ibmUpgrade linux-oracle-5.15Upgrade linux-gcp-5.4Upgrade linux-nvidia-tegra-igxUpgrade linux-oracleUpgrade linux-lowlatencyUpgrade linux-intel-iotg-5.15Upgrade linux-azure-5.15Upgrade linux-iotUpgrade linux-aws-fipsUpgrade linux-azure-5.4Upgrade linux-azure-fde-5.15Upgrade linux-realtimeUpgrade linux-fipsUpgrade linux-nvidia | Oct 10, 2025 | Oct 4, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 15, 2025 | Oct 4, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub