Description
In the Linux kernel, the following vulnerability has been resolved: usbnet:fix NPE during rx_complete Missing usbnet_going_away Check in Critical Path. The usb_submit_urb function lacks a usbnet_going_away validation, whereas __usbnet_queue_skb includes this check. This inconsistency creates a race condition where: A URB request may succeed, but the corresponding SKB data fails to be queued. Subsequent processes: (e.g., rx_complete → defer_bh → __skb_unlink(skb, list)) attempt to access skb->next, triggering a NULL pointer dereference (Kernel Panic).
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
b80aacfea6e8d6ed6e430aa13922d6ccf044415a to < 95789c2f94fd29dce8759f9766baa333f749287caffected869caa8de8cb94514df704ccbe0b024fda4b9398 to < 0f10f83acfd619e13c64d6705908dfd792f19544affected1e44ee6cdd123d6cfe78b4a94e1572e23bbb58ce to < acacd48a37b52fc95f621765762c04152b58d642affected04e906839a053f092ef53f4fb2d610983412b904 to < d689645cd1594ea1d13cb0c404f8ad1011353e0eaffected04e906839a053f092ef53f4fb2d610983412b904 to < 0c30988588b28393e3e8873d5654f910e86391baaffected04e906839a053f092ef53f4fb2d610983412b904 to < fd9ee3f0d6a53844f65efde581c91bbb0ff749acaffected04e906839a053f092ef53f4fb2d610983412b904 to < 51de3600093429e3b712e5f091d767babc5dd6dfaffectedca124236cd14e61610f56df9a8f81376a1ffe660affected54671d731f4977fb3c0c26f2840655b5204e4437affected5.15.168 to < 5.15.180affected6.1.113 to < 6.1.134affected6.6.54 to < 6.6.87affected6.10.13 to < 6.11affected6.11.2 to < 6.12affected
Linux Linux
Default version status: affected
6.12affected0 to < 6.12unaffected5.15.180 to ≤ 5.15.*unaffected6.1.134 to ≤ 6.1.*unaffected6.6.87 to ≤ 6.6.*unaffected6.12.23 to ≤ 6.12.*unaffected6.13.11 to ≤ 6.13.*unaffected6.14.2 to ≤ 6.14.*unaffected6.15 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/95789c2f94fd29dce8759f9766baa333f749287c ↗
- https://git.kernel.org/stable/c/0f10f83acfd619e13c64d6705908dfd792f19544 ↗
- https://git.kernel.org/stable/c/acacd48a37b52fc95f621765762c04152b58d642 ↗
- https://git.kernel.org/stable/c/d689645cd1594ea1d13cb0c404f8ad1011353e0e ↗
- https://git.kernel.org/stable/c/0c30988588b28393e3e8873d5654f910e86391ba ↗
- https://git.kernel.org/stable/c/fd9ee3f0d6a53844f65efde581c91bbb0ff749ac ↗
- https://git.kernel.org/stable/c/51de3600093429e3b712e5f091d767babc5dd6df ↗
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html ↗