CVE-2026-74680

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()<br /> <br /> If cxacru_cm() encounters an error while submitting or waiting for snd_urb,<br /> it aborts and returns the error without killing the already submitted<br /> rcv_urb. This leaves the rcv_urb active.<br /> <br /> When this happens during initialization (e.g., in cxacru_atm_start()), the<br /> driver may ignore the error and proceed to call cxacru_poll_status(), which<br /> invokes cxacru_cm() again. Attempting to submit the still-active rcv_urb<br /> triggers a warning in usb_submit_urb():<br /> <br /> cxacru 1-1:1.0: send of cm 0x84 failed (-104)<br /> ATM dev 0: cxacru_atm_start: CHIP_ADSL_LINE_START returned -104<br /> ------------[ cut here ]------------<br /> URB ffff88812658d200 submitted while active<br /> WARNING: drivers/usb/core/urb.c:379 at usb_submit_urb+0x79/0x18b0<br /> drivers/usb/core/urb.c:379<br /> ...<br /> Call Trace:<br /> <br /> cxacru_cm+0x21a/0xf10 drivers/usb/atm/cxacru.c:631<br /> cxacru_cm_get_array drivers/usb/atm/cxacru.c:722 [inline]<br /> cxacru_poll_status+0x178/0x1110 drivers/usb/atm/cxacru.c:828<br /> cxacru_atm_start+0x185/0x360 drivers/usb/atm/cxacru.c:814<br /> usbatm_atm_init+0x144/0x3a0 drivers/usb/atm/usbatm.c:927<br /> usbatm_usb_probe+0x15cb/0x1db0 drivers/usb/atm/usbatm.c:1178<br /> cxacru_usb_probe+0x17f/0x220 drivers/usb/atm/cxacru.c:1370<br /> ...<br /> <br /> To fix this, ensure that rcv_urb is properly killed if cxacru_cm() aborts<br /> early. We can safely call usb_kill_urb() on rcv_urb in the error path, as<br /> it is safe to call even if the URB is not active (e.g., if it failed to<br /> submit in the first place, or if it already completed).