CVE-2026-74677

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: usb: ipheth: fix carrier_work UAF on disconnect

ipheth_sndbulk_callback() re-arms the carrier-check work on any

non-zero URB status:

else

schedule_delayed_work(&dev->carrier_work, 0);

Nothing ties that to the interface being up, so the work can be armed

again after ipheth_close() has already drained it, and stay armed

until the netdev whose private area embeds it is freed.

On unplug with a TX URB in flight, ipheth_disconnect() drains the work

through unregister_netdev() -> ipheth_close() ->

cancel_delayed_work_sync() and only then calls ipheth_kill_urbs().

usb_kill_urb() completes the in-flight TX URB with -ENOENT, so

ipheth_sndbulk_callback() runs after the drain and re-arms

carrier_work.

The same completion also re-arms the work if the interface is only

brought down while a TX URB is in flight, and

ipheth_carrier_check_work() then keeps re-queueing itself once a

second. unregister_netdev() does not call

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References