CVE-2026-43180 Overview
CVE-2026-43180 is a Linux kernel vulnerability in the kaweth USB Ethernet driver. The flaw resides in kaweth_set_rx_mode(), which serves as the ndo_set_rx_mode callback. The function incorrectly invokes netif_stop_queue() and netif_wake_queue(), which are TX queue flow-control primitives unrelated to RX multicast configuration. The premature netif_wake_queue() call can re-enable the transmit queue while tx_urb remains in flight. This race triggers a double usb_submit_urb() on the same URB, producing the kernel warning "URB submitted while active" and potentially destabilizing the network stack.
Critical Impact
A local race condition in the kaweth USB driver leads to double USB Request Block (URB) submission, kernel warnings, and possible network stack instability on systems using affected USB Ethernet adapters.
Affected Products
- Linux kernel — drivers/net/usb/kaweth.c (kaweth USB Ethernet driver)
- Multiple stable kernel branches prior to the fix commits referenced in git.kernel.org
- Systems using KL5KUSB101-based USB Ethernet adapters
Discovery Timeline
- 2026-05-06 - CVE-2026-43180 published to NVD
- 2026-05-06 - Last updated in NVD database
Technical Details for CVE-2026-43180
Vulnerability Analysis
The vulnerability is a race condition [CWE-362] in the kaweth USB Ethernet driver. The ndo_set_rx_mode callback is intended to configure receive-side multicast filtering. In the kaweth driver, however, kaweth_set_rx_mode() calls netif_stop_queue() followed by netif_wake_queue(). These calls manipulate the transmit queue state and have no semantic relationship to RX configuration.
When the kernel invokes kaweth_set_rx_mode() while a transmit operation is in progress, the call sequence wakes the TX queue before the in-flight tx_urb has completed. The next invocation of kaweth_start_xmit() then submits the same URB again through usb_submit_urb(), while the URB is still active in the USB core. This violates USB core invariants and triggers the WARN in usb_submit_urb() with the message "URB submitted while active".
The issue mirrors a previously fixed defect in the rtl8150 driver, addressed in commit 958baf5eaee3 ("net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast"). The kaweth set_rx_mode was already non-functional for its stated purpose, since the actual multicast configuration is performed by kaweth_async_set_rx_mode() and only takes effect at ndo_open() time.
Root Cause
The root cause is the misuse of TX flow-control primitives inside an RX-mode callback. netif_wake_queue() is called without coordination with the URB lifecycle, allowing concurrent submissions of the same tx_urb structure.
Attack Vector
Triggering the condition requires local interaction with the network interface and an attached kaweth-compatible USB Ethernet device. Routine multicast updates from the network stack during active transmission can reproduce the race; no remote network input is required.
The vulnerability manifests in the kaweth driver's queue-management logic. Refer to the upstream fix in the Linux Kernel Commit for the precise code change.
Detection Methods for CVE-2026-43180
Indicators of Compromise
- Kernel log entries containing the string URB submitted while active originating from usb_submit_urb()
- Stack traces referencing kaweth_start_xmit and kaweth_set_rx_mode in dmesg output
- Network interface stalls or TX hangs on systems using KL5KUSB101 USB Ethernet adapters
Detection Strategies
- Monitor dmesg and /var/log/kern.log for WARN messages emitted by the USB core when duplicate URB submissions occur
- Inventory hosts that load the kaweth kernel module via lsmod | grep kaweth and correlate against kernel build versions
- Compare running kernel versions against the fix commits listed in the upstream stable tree references
Monitoring Recommendations
- Forward kernel ring buffer logs to a centralized logging platform and alert on USB core warnings
- Track network interface error counters with ethtool -S and ip -s link for anomalous TX errors on kaweth-managed interfaces
- Audit multicast group membership changes that coincide with kernel warning events
How to Mitigate CVE-2026-43180
Immediate Actions Required
- Apply the kernel update containing the upstream fix that removes the TX queue manipulation from kaweth_set_rx_mode()
- Identify and update systems running kernel versions prior to the patched stable releases
- If patching cannot be performed immediately, unload the kaweth module on systems where it is not required
Patch Information
The fix removes the erroneous netif_stop_queue() and netif_wake_queue() calls from kaweth_set_rx_mode(). Patches have been applied across multiple stable branches. See the upstream commits: 443a830b1dc4, 586318c27304, 64868f5ecade, 8367c0e90126, 9c79b839a639, a2cd4b4db315, ef9b10a02050, and fc393af769af.
Workarounds
- Blacklist the kaweth module on systems that do not require KL5KUSB101 USB Ethernet support
- Disconnect or disable USB Ethernet adapters that bind to the kaweth driver until patches are deployed
- Limit administrative actions that trigger multicast filter updates on affected interfaces during peak traffic
# Blacklist the kaweth driver until the kernel is patched
echo "blacklist kaweth" | sudo tee /etc/modprobe.d/blacklist-kaweth.conf
sudo rmmod kaweth 2>/dev/null
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
