CVE-2026-74677 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
net: usb: ipheth: fix carrier_work UAF on disconnect
ipheth_sndbulk_callback() re-arms the carrier-check work on any non-zero URB status:
else schedule_delayed_work(&dev->carrier_work, 0);
Nothing ties that to the interface being up, so the work can be armed again after ipheth_close() has already drained it, and stay armed until the netdev whose private area embeds it is freed.
On unplug with a TX URB in flight, ipheth_disconnect() drains the work through unregister_netdev() -> ipheth_close() -> cancel_delayed_work_sync() and only then calls ipheth_kill_urbs(). usb_kill_urb() completes the in-flight TX URB with -ENOENT, so ipheth_sndbulk_callback() runs after the drain and re-arms carrier_work.
The same completion also re-arms the work if the interface is only brought down while a TX URB is in flight, and ipheth_carrier_check_work() then keeps re-queueing itself once a second. unregister_netdev() does not call ipheth_close() for an already-down interface, so nothing drains it on the later unplug either.
In both cases free_netdev() frees the netdev while carrier_work is still pending, and ipheth_carrier_check_work() dereferences freed memory.
Tie the work to the interface state instead of chasing the completion: disable it in ipheth_close() and enable it in ipheth_open(), so a schedule_delayed_work() from the URB completion is a no-op whenever the interface is not up. disable_delayed_work_sync() also waits for a running instance, so it fully replaces the cancel_delayed_work_sync() it takes the place of. The work starts out disabled in ipheth_probe() so the enable/disable counts balance from the first open.
Reproduced under KASAN on linux-next (next-20260731) with dummy_hcd and raw-gadget standing in for the device, driving the second path above (the interface is already down, so unregister_netdev() does not call ipheth_close()): 15 of 15 unpatched boots report a slab-use-after-free in __run_timers(), freed by ipheth_disconnect() and re-armed from ipheth_sndbulk_callback() via queue_delayed_work_on(). The same trigger on a kernel differing only by this patch reports 0 of 15, and the carrier check still functions across open/close cycles.
The reproducer needs an attached USB device that stops draining bulk OUT, plus a link down and unplug, driven as root. It is not a privilege boundary crossing and no exploit primitive was developed.
Found by 0sec (https://0sec.ai).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/22/2026
This vulnerability represents a classic use-after-free condition within the Linux kernel’s network subsystem, specifically affecting the ipheth USB Ethernet driver used for Apple iPhone tethering devices. The root cause lies in an improper synchronization mechanism between the asynchronous completion of USB Uninterruptible Transfer Requests and the lifecycle management of the network device structure. When a bulk OUT transfer is submitted to send data, it operates asynchronously. If this transfer remains in flight when the interface is closed or disconnected, the driver’s callback function ipheth_sndbulk_callback() executes upon URB completion. The flawed logic dictates that if the status code is non-zero, indicating an error or termination such as -ENOENT from usb_kill_urb(), the work item carrier_work is re-armed via schedule_delayed_work(). This action occurs regardless of whether the network interface is currently active or has already been torn down by ipheth_close() and unregister_netdev().
The operational impact stems from a race condition where the kernel frees the net_device structure while a delayed work item still holds a reference to it. Specifically, during an unplug event with a pending TX URB, the disconnect routine drains existing work items through cancel_delayed_work_sync(), but this happens before usb_kill_urb() completes the in-flight transfer. Consequently, the callback runs after the drain phase and schedules carrier_check_work again. Since unregister_netdev does not invoke ipheth_close if the interface is already down, subsequent unplugs leave this re-armed work item pending. When free_netdev eventually releases the memory associated with the network device, any future execution of ipheth_carrier_check_work results in a slab-use-after-free as it attempts to dereference pointers within the now-freed private data area. This can lead to kernel panics, system instability, or potentially arbitrary code execution if an attacker can control the contents of the freed memory region and trigger its reallocation with malicious structures.
From a classification perspective, this vulnerability aligns closely with CWE-416 Use After Free, as it involves accessing memory after it has been released back to the allocator. The attack vector is categorized under ATT&CK technique T1059 Command and Scripting Interpreter if considering potential exploitation via kernel module loading or script injection following a crash, though more directly it relates to local privilege escalation vectors where stability issues are leveraged for denial of service or further memory corruption exploits. The vulnerability does not cross privilege boundaries by itself but creates an unstable state that can be exploited locally by root users who have the capability to attach and detach USB devices rapidly while manipulating network interface states.
Mitigation strategies primarily involve applying the upstream kernel patch which corrects the lifecycle management logic. The fix ties the carrier check work item directly to the operational state of the network interface rather than relying on URB completion status alone. By disabling the work in ipheth_close and enabling it only in ipheth_open, any attempt to schedule delayed work from a completed URB becomes a no-op if the interface is down. Additionally, using disable_delayed_work_sync ensures that running instances are waited upon before proceeding with cleanup, effectively replacing the previous cancel logic which failed to account for re-scheduling during completion handlers. System administrators should ensure their kernels are updated to versions containing this fix and restrict physical access to USB ports where possible to prevent unauthorized device attachment scenarios that could trigger these race conditions in unpatched systems.