CVE-2026-74677: net: usb: ipheth: fix carrier_work UAF on disconnect
In the Linux kernel, the following vulnerability has been resolved:
net: usb: ipheth: fix carrierwork UAF on disconnect
iphethsndbulkcallback() re-arms the carrier-check work on any non-zero URB status:
else scheduledelayedwork(&dev->carrierwork, 0);
Nothing ties that to the interface being up, so the work can be armed again after iphethclose() has already drained it, and stay armed until the netdev whose private area embeds it is freed.
On unplug with a TX URB in flight, iphethdisconnect() drains the work through unregisternetdev() -> iphethclose() -> canceldelayedworksync() and only then calls iphethkillurbs(). usbkillurb() completes the in-flight TX URB with -ENOENT, so iphethsndbulkcallback() runs after the drain and re-arms carrierwork.
The same completion also re-arms the work if the interface is only brought down while a TX URB is in flight, and iphethcarriercheckwork() then keeps re-queueing itself once a second. unregisternetdev() does not call iphethclose() for an already-down interface, so nothing drains it on the later unplug either.
In both cases freenetdev() frees the netdev while carrierwork is still pending, and iphethcarriercheckwork() dereferences freed memory.
Tie the work to the interface state instead of chasing the completion: disable it in iphethclose() and enable it in iphethopen(), so a scheduledelayedwork() from the URB completion is a no-op whenever the interface is not up. disabledelayedworksync() also waits for a running instance, so it fully replaces the canceldelayedworksync() it takes the place of. The work starts out disabled in iphethprobe() so the enable/disable counts balance from the first open.
Reproduced under KASAN on linux-next (next-20260731) with dummyhcd and raw-gadget standing in for the device, driving the second path above (the interface is already down, so unregisternetdev() does not call iphethclose()): 15 of 15 unpatched boots report a slab-use-after-free in runtimers(), freed by iphethdisconnect() and re-armed from iphethsndbulkcallback() via queuedelayedworkon(). The same trigger on a kernel differing only by this patch reports 0 of 15, and the carrier check still functions across open/close cycles.
The reproducer needs an attached USB device that stops draining bulk OUT, plus a link down and unplug, driven as root. It is not a privilege boundary crossing and no exploit primitive was developed.
Found by 0sec (https://0sec.ai).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Configuration
Tie carrier_work to the interface state: enable it in ipheth_open(), disable it in ipheth_close(), and use disable_delayed_work_sync() in place of cancel_delayed_work_sync() so a running instance is waited for and URB-completion scheduling is a no-op while the interface is down.
Linux kernel net/usb/ipheth carrier_work lifecycle = disable in ipheth_close() and enable in ipheth_open()
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel ipheth USB network driver are exposed when an affected iPhone USB Ethernet device is disconnected or its interface is brought down while a transmit URB is still in flight.
What event is required to trigger the use-after-free condition?
A TX URB must be active when the interface is brought down or the USB device is unplugged. Its completion with a non-zero status can re-arm carrier_work after it was drained, leaving work pending after the netdev is freed.
Can an interface that is already down still be affected during later unplug?
Yes. If the earlier TX completion re-armed carrier_work while the interface was brought down, the work can remain queued; unregister_netdev() does not call ipheth_close() for an already-down interface, so a later unplug may free the netdev with the work still pending.
What is the practical mitigation if an updated kernel cannot be deployed immediately?
Avoid disconnecting the affected USB network device or bringing its interface down while transmit activity is in flight. Ensure traffic has stopped before administrative interface shutdown or device removal.