In the Linux kernel, the following vulnerability has been resolved:
net: usb: kaweth: remove TX queue manipulation in kawethsetrx_mode
kawethsetrxmode(), the ndosetrxmode callback, calls netifstopqueue() and netifwakequeue(). These are TX queue flow control functions unrelated to RX multicast configuration.
The premature netifwakequeue() can re-enable TX while txurb is still in-flight, leading to a double usbsubmit_urb() on the same URB:
kawethstartxmit() { netifstopqueue(); usbsubmiturb(kaweth->tx_urb); }
kawethsetrxmode() { netifstopqueue(); netifwake_queue(); // wakes TX queue before URB is done }
kawethstartxmit() { netifstopqueue(); usbsubmiturb(kaweth->tx_urb); // URB submitted while active }
This triggers the WARN in usbsubmiturb():
"URB submitted while active"
This is a similar class of bug fixed in rtl8150 by
Also kawethsetrxmode() is already functionally broken, the real setrxmode action is performed by kawethasyncsetrxmode(), which in turn is not a no-op only at ndoopen() time.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43180.json",
"cna_assigner": "Linux"
}