Description
In the Linux kernel, the following vulnerability has been resolved: net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() When the interface has NETIF_F_SG enabled and skb_linearize() fails in ax88179_tx_fixup(), the function returns NULL without freeing the skb. usbnet_start_xmit() treats a NULL return from tx_fixup() as a drop (info->flags does not set FLAG_MULTI_PACKET for this driver), jumping to the "drop" label where it does `if (skb) dev_kfree_skb_any(skb)`. Because tx_fixup() returned NULL, the local skb variable in usbnet_start_xmit() is NULL, so the original skb is never freed — a memory leak on every TX frame whose linearization fails (i.e. under memory pressure). Free the skb before returning, matching the error handling already used for the pskb_expand_head() failure path in the same function.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
16b1c4e01c89ba07367461e0bc4cb84993c2d027 to < 83a765cbd7b4d11b0b9fa1bb9d941ae911a2159baffected16b1c4e01c89ba07367461e0bc4cb84993c2d027 to < 1c63303659a2264bd55d9813df74cb4caeed5922affected16b1c4e01c89ba07367461e0bc4cb84993c2d027 to < 2be5091fa693b9119ad25a8bb8c149d236a23adeaffected16b1c4e01c89ba07367461e0bc4cb84993c2d027 to < 58733b1dd46bb231d9d279c132a20ee46da1b664affected16b1c4e01c89ba07367461e0bc4cb84993c2d027 to < 4039cd807a5a46dc5f7618fffae926b8ad8455ebaffected16b1c4e01c89ba07367461e0bc4cb84993c2d027 to < 1f428e30947395d9b9aacee03e25a4e6cfcad7a4affected
Linux Linux
Default version status: affected
5.17affected0 to < 5.17unaffected6.1.183 to ≤ 6.1.*unaffected6.6.152 to ≤ 6.6.*unaffected6.12.104 to ≤ 6.12.*unaffected6.18.45 to ≤ 6.18.*unaffected7.1.9 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/83a765cbd7b4d11b0b9fa1bb9d941ae911a2159b ↗
- https://git.kernel.org/stable/c/1c63303659a2264bd55d9813df74cb4caeed5922 ↗
- https://git.kernel.org/stable/c/2be5091fa693b9119ad25a8bb8c149d236a23ade ↗
- https://git.kernel.org/stable/c/58733b1dd46bb231d9d279c132a20ee46da1b664 ↗
- https://git.kernel.org/stable/c/4039cd807a5a46dc5f7618fffae926b8ad8455eb ↗
- https://git.kernel.org/stable/c/1f428e30947395d9b9aacee03e25a4e6cfcad7a4 ↗