CVE-2026-63874: net: mctp: usb: fix race between urb completion and rx_retry cancellation
In the Linux kernel, the following vulnerability has been resolved:
net: mctp: usb: fix race between urb completion and rxretry cancellation
It's possible that sequencing between setting ->stopped and cancelling the rxretry work (in ndostop) could leave us with an urb queued:
T1: ndostop T2: rxretrywork ------------ ---------------- LD: ->stopped => false ST: ->stopped <= true usbkillurb() mctpusbrxqueue() usbsubmiturb() canceldelayedworksync()
That urb completion can then re-schedule rxretrywork.
Strenghen the sequencing between the stop (preventing another requeue) and the cancel by updating both atomically under a new rx lock. After setting ->rxstopped, and cancelling pending work, we know that the requeue cannot occur, so all that's left is killing any pending urb.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63874?
The severity of CVE-2026-63874 is high with a CVSS score of 7.8.
How do I fix CVE-2026-63874?
To fix CVE-2026-63874, update the Linux kernel to the latest version where this vulnerability has been patched.
What systems are affected by CVE-2026-63874?
CVE-2026-63874 affects systems running vulnerable versions of the Linux kernel.
What types of attacks can CVE-2026-63874 potentially facilitate?
CVE-2026-63874 can potentially enable remote code execution due to the race condition in the USB processing.
When was CVE-2026-63874 published?
CVE-2026-63874 was published on July 19, 2026.