net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()
In the Linux kernel, the following vulnerability has been resolved: net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() When the interface has NETIF_F_SG enabled and skb_linearize() fails in ax88179_tx_fixup(), the function returns NULL without freeing the skb. usbnet_start_xmit() treats a NULL return from tx_fixup() as a drop (info->flags does not set FLAG_MULTI_PACKET for this driver), jumping to the "drop" label where it does `if (skb) dev_kfree_skb_any(skb)`. Because tx_fixup() returned NULL, the local skb variable in usbnet_start_xmit() is NULL, so the original skb is never freed — a memory leak on every TX frame whose linearization fails (i.e. under memory pressure). Free the skb before returning, matching the error handling already used for the pskb_expand_head() failure path in the same function.
CVE-2026-74678
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-74678
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
"lessThan": "83a765cbd7b4d11b0b9fa1bb9d941ae911a2159b",
"versionType": "git"
},
{
"status": "affected",
"version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
"lessThan": "1c63303659a2264bd55d9813df74cb4caeed5922",
"versionType": "git"
},
{
"status": "affected",
"version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
"lessThan": "2be5091fa693b9119ad25a8bb8c149d236a23ade",
"versionType": "git"
},
{
"status": "affected",
"version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
"lessThan": "58733b1dd46bb231d9d279c132a20ee46da1b664",
"versionType": "git"
},
{
"status": "affected",
"version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
"lessThan": "4039cd807a5a46dc5f7618fffae926b8ad8455eb",
"versionType": "git"
},
{
"status": "affected",
"version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
"lessThan": "1f428e30947395d9b9aacee03e25a4e6cfcad7a4",
"versionType": "git"
}
],
"programFiles": [
"drivers/net/usb/ax88179_178a.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.17",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/net/usb/ax88179_178a.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-74678
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #34270 · Revision 1
- Added to Heist Feed
- Publisher date