CVE-2026-74678: net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()
In the Linux kernel, the following vulnerability has been resolved:
net: usb: ax88179178a: fix skb leak in ax88179txfixup()
When the interface has NETIFFSG enabled and skblinearize() fails in ax88179txfixup(), the function returns NULL without freeing the skb.
usbnetstartxmit() treats a NULL return from txfixup() as a drop (info->flags does not set FLAGMULTIPACKET for this driver), jumping to the "drop" label where it does if (skb) devkfreeskbany(skb). Because txfixup() returned NULL, the local skb variable in usbnetstartxmit() is NULL, so the original skb is never freed — a memory leak on every TX frame whose linearization fails (i.e. under memory pressure).
Free the skb before returning, matching the error handling already used for the pskbexpandhead() failure path in the same function.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.152.1-1
Event History
Frequently Asked Questions
What conditions are required for this leak to occur?
The AX88179/178A USB network interface must have NETIF_F_SG enabled, and skb_linearize() must fail while processing a transmitted frame. The description identifies memory pressure as the condition under which this failure can occur.
What is the practical impact?
One socket buffer is leaked for each transmitted frame whose linearization fails. Repeated failures under memory pressure can consume kernel memory.
Is this reachable through normal transmit processing?
Yes. The leak occurs in the driver's transmit fixup path when a frame requires linearization and that operation fails; usbnet_start_xmit() then treats the NULL result as a dropped packet but cannot free the original buffer.
What mitigation is available if the fix cannot be applied immediately?
The provided information only identifies the triggering condition: failures of skb_linearize() under memory pressure with NETIF_F_SG enabled. Reducing memory-pressure conditions may reduce opportunities for the leak, but no specific configuration workaround is provided.