CVE-2026-74677

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: usb: ipheth: fix carrier_work UAF on disconnect<br /> <br /> ipheth_sndbulk_callback() re-arms the carrier-check work on any<br /> non-zero URB status:<br /> <br /> else<br /> schedule_delayed_work(&amp;dev-&gt;carrier_work, 0);<br /> <br /> Nothing ties that to the interface being up, so the work can be armed<br /> again after ipheth_close() has already drained it, and stay armed<br /> until the netdev whose private area embeds it is freed.<br /> <br /> On unplug with a TX URB in flight, ipheth_disconnect() drains the work<br /> through unregister_netdev() -&gt; ipheth_close() -&gt;<br /> cancel_delayed_work_sync() and only then calls ipheth_kill_urbs().<br /> usb_kill_urb() completes the in-flight TX URB with -ENOENT, so<br /> ipheth_sndbulk_callback() runs after the drain and re-arms<br /> carrier_work.<br /> <br /> The same completion also re-arms the work if the interface is only<br /> brought down while a TX URB is in flight, and<br /> ipheth_carrier_check_work() then keeps re-queueing itself once a<br /> second. unregister_netdev() does not call ipheth_close() for an<br /> already-down interface, so nothing drains it on the later unplug<br /> either.<br /> <br /> In both cases free_netdev() frees the netdev while carrier_work is<br /> still pending, and ipheth_carrier_check_work() dereferences freed<br /> memory.<br /> <br /> Tie the work to the interface state instead of chasing the completion:<br /> disable it in ipheth_close() and enable it in ipheth_open(), so a<br /> schedule_delayed_work() from the URB completion is a no-op whenever<br /> the interface is not up. disable_delayed_work_sync() also waits for a<br /> running instance, so it fully replaces the cancel_delayed_work_sync()<br /> it takes the place of. The work starts out disabled in ipheth_probe()<br /> so the enable/disable counts balance from the first open.<br /> <br /> Reproduced under KASAN on linux-next (next-20260731) with dummy_hcd and<br /> raw-gadget standing in for the device, driving the second path above (the<br /> interface is already down, so unregister_netdev() does not call<br /> ipheth_close()): 15 of 15 unpatched boots report a slab-use-after-free in<br /> __run_timers(), freed by ipheth_disconnect() and re-armed from<br /> ipheth_sndbulk_callback() via queue_delayed_work_on(). The<br /> same trigger on a kernel differing only by this patch reports 0 of 15,<br /> and the carrier check still functions across open/close cycles.<br /> <br /> The reproducer needs an attached USB device that stops draining bulk OUT,<br /> plus a link down and unplug, driven as root. It is not a privilege<br /> boundary crossing and no exploit primitive was developed.<br /> <br /> Found by 0sec (https://0sec.ai).