CVE-2026-74680: usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
In the Linux kernel, the following vulnerability has been resolved:
usb: atm: cxacru: properly kill rcvurb on error in cxacrucm()
If cxacrucm() encounters an error while submitting or waiting for sndurb, it aborts and returns the error without killing the already submitted rcvurb. This leaves the rcvurb active.
When this happens during initialization (e.g., in cxacruatmstart()), the driver may ignore the error and proceed to call cxacrupollstatus(), which invokes cxacrucm() again. Attempting to submit the still-active rcvurb triggers a warning in usbsubmiturb():
cxacru 1-1:1.0: send of cm 0x84 failed (-104) ATM dev 0: cxacruatmstart: CHIPADSLLINESTART returned -104 ------------[ cut here ]------------ URB ffff88812658d200 submitted while active WARNING: drivers/usb/core/urb.c:379 at usbsubmiturb+0x79/0x18b0 drivers/usb/core/urb.c:379 ... Call Trace: <TASK> cxacrucm+0x21a/0xf10 drivers/usb/atm/cxacru.c:631 cxacrucmgetarray drivers/usb/atm/cxacru.c:722 [inline] cxacrupollstatus+0x178/0x1110 drivers/usb/atm/cxacru.c:828 cxacruatmstart+0x185/0x360 drivers/usb/atm/cxacru.c:814 usbatmatminit+0x144/0x3a0 drivers/usb/atm/usbatm.c:927 usbatmusbprobe+0x15cb/0x1db0 drivers/usb/atm/usbatm.c:1178 cxacruusbprobe+0x17f/0x220 drivers/usb/atm/cxacru.c:1370 ...
To fix this, ensure that rcvurb is properly killed if cxacrucm() aborts early. We can safely call usbkillurb() on rcvurb in the error path, as it is safe to call even if the URB is not active (e.g., if it failed to submit in the first place, or if it already completed).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the cxacru driver error path so that when cxacru_cm() fails while submitting or waiting for snd_urb, it also safely kills the already-submitted rcv_urb by calling usb_kill_urb() (rcv_urb may be killed even if it is not active). This prevents the WARNING in usb_submit_urb() about 'URB ... submitted while active' and eliminates the warning 'usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()'.
Linux kernel USB core (drivers/usb/core/urb.c) / cxacru driver (drivers/usb/atm/cxacru.c) Ensure rcv_urb is properly killed on error path when cxacru_cm() aborts = Call usb_kill_urb() on rcv_urb in the error path in cxacru_cm() (including during initialization like cxacru_atm_start())
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel cxacru USB ATM driver are affected when cxacru_cm() encounters an error after the receive URB has already been submitted. The described failure can occur during driver initialization, including cxacru_atm_start().
What conditions trigger the warning?
A failure while submitting or waiting for snd_urb causes cxacru_cm() to return without killing the active rcv_urb. If the driver then calls cxacru_cm() again, such as through cxacru_poll_status(), it attempts to submit the still-active receive URB and triggers the usb_submit_urb() warning.
How can administrators identify that the issue has occurred?
Kernel logs may show "URB ... submitted while active" from drivers/usb/core/urb.c, along with cxacru messages such as "send of cm 0x84 failed (-104)" and a call trace involving cxacru_cm(), cxacru_poll_status(), and cxacru_atm_start().