CVE-2026-74680: usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
In the Linux kernel, the following vulnerability has been resolved:
usb: atm: cxacru: properly kill rcvurb on error in cxacrucm()
If cxacrucm() encounters an error while submitting or waiting for sndurb, it aborts and returns the error without killing the already submitted rcvurb. This leaves the rcvurb active.
When this happens during initialization (e.g., in cxacruatmstart()), the driver may ignore the error and proceed to call cxacrupollstatus(), which invokes cxacrucm() again. Attempting to submit the still-active rcvurb triggers a warning in usbsubmiturb():
cxacru 1-1:1.0: send of cm 0x84 failed (-104) ATM dev 0: cxacruatmstart: CHIPADSLLINESTART returned -104 ------------[ cut here ]------------ URB ffff88812658d200 submitted while active WARNING: drivers/usb/core/urb.c:379 at usbsubmiturb+0x79/0x18b0 drivers/usb/core/urb.c:379 ... Call Trace: <TASK> cxacrucm+0x21a/0xf10 drivers/usb/atm/cxacru.c:631 cxacrucmgetarray drivers/usb/atm/cxacru.c:722 [inline] cxacrupollstatus+0x178/0x1110 drivers/usb/atm/cxacru.c:828 cxacruatmstart+0x185/0x360 drivers/usb/atm/cxacru.c:814 usbatmatminit+0x144/0x3a0 drivers/usb/atm/usbatm.c:927 usbatmusbprobe+0x15cb/0x1db0 drivers/usb/atm/usbatm.c:1178 cxacruusbprobe+0x17f/0x220 drivers/usb/atm/cxacru.c:1370 ...
To fix this, ensure that rcvurb is properly killed if cxacrucm() aborts early. We can safely call usbkillurb() on rcvurb in the error path, as it is safe to call even if the URB is not active (e.g., if it failed to submit in the first place, or if it already completed).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the cxacru driver error path so that when cxacru_cm() fails while submitting or waiting for snd_urb, it also safely kills the already-submitted rcv_urb by calling usb_kill_urb() (rcv_urb may be killed even if it is not active). This prevents the WARNING in usb_submit_urb() about 'URB ... submitted while active' and eliminates the warning 'usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()'.
Linux kernel USB core (drivers/usb/core/urb.c) / cxacru driver (drivers/usb/atm/cxacru.c) Ensure rcv_urb is properly killed on error path when cxacru_cm() aborts = Call usb_kill_urb() on rcv_urb in the error path in cxacru_cm() (including during initialization like cxacru_atm_start())