CVE-2026-43180

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode

kaweth_set_rx_mode(), the ndo_set_rx_mode callback, calls

netif_stop_queue() and netif_wake_queue(). These are TX queue flow

control functions unrelated to RX multicast configuration.

The premature netif_wake_queue() can re-enable TX while tx_urb is still

in-flight, leading to a double usb_submit_urb() on the same URB:

kaweth_start_xmit() {

netif_stop_queue();

usb_submit_urb(kaweth->tx_urb);

}

kaweth_set_rx_mode() {

netif_stop_queue();

netif_wake_queue(); // wakes TX queue before URB is done

}

kaweth_start_xmit() {

netif_stop_queue();

usb_submit_urb(kaweth->tx_urb); // URB submitted while active

}

This triggers the WARN in usb_submit_urb():

"URB submitted while active"

This is a similar class of bug fixed in rtl8150 by

- commit 958baf5eaee3 ("net: usb: Remove disruptive netif_wake_queue in rtl8150_set_mu

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References