CVE-2026-63874 Overview
CVE-2026-63874 is a race condition in the Linux kernel's Management Component Transport Protocol (MCTP) over USB transport layer. The flaw exists in the sequencing between ndo_stop and the rx_retry_work delayed work handler. A concurrent execution window allows a USB Request Block (URB) to be requeued after the driver believes it has stopped, leaving a URB active after cancel_delayed_work_sync() returns. The vulnerability was resolved by introducing a new rx_lock that atomically updates the ->rx_stopped flag and cancels pending work, preventing further requeues.
Critical Impact
Local attackers with the ability to exercise MCTP USB interface teardown can trigger memory corruption or use-after-free conditions in kernel space, impacting confidentiality, integrity, and availability.
Affected Products
- Linux kernel versions containing the net/mctp/usb transport driver prior to the fix commits
- Kernel builds with CONFIG_MCTP_TRANSPORT_USB enabled
- Stable kernel branches receiving backports 54665dce982, 9c46f3ee183, and d90feaa3f74
Discovery Timeline
- 2026-07-19 - CVE-2026-63874 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-63874
Vulnerability Analysis
The vulnerability is a race condition [CWE-362] in the MCTP USB driver's shutdown path. When a network device stop operation (ndo_stop) runs concurrently with the rx_retry_work delayed work item, the two threads can interleave in a way that leaves a submitted URB outstanding after driver teardown believes it has completed cleanup.
The original code sets ->stopped to true, calls usb_kill_urb(), then calls cancel_delayed_work_sync(). If rx_retry_work reads ->stopped as false before the store, it can proceed to mctp_usb_rx_queue() and invoke usb_submit_urb() after usb_kill_urb() has already run. The completion of that late-submitted URB can then reschedule rx_retry_work again, defeating the cancellation.
Root Cause
The root cause is missing atomicity between the stop flag update and the cancellation of pending work. The ->stopped check in rx_retry_work and the store in ndo_stop were not serialized under a common lock, permitting the retry worker to observe the pre-stop state and requeue an URB during teardown.
Attack Vector
Exploitation requires local access with the ability to interact with an MCTP USB network device, typically through ip link operations or USB device removal events. An attacker who can repeatedly bring the interface up and down while inducing RX retry conditions can widen the race window. The resulting URB use-after-free or dangling work item can lead to kernel memory corruption and privilege escalation on affected systems.
No verified public exploit code exists for this vulnerability. Refer to the upstream patch commits for the precise fix: Kernel Patch 54665dce982, Kernel Patch 9c46f3ee183, and Kernel Patch d90feaa3f74.
Detection Methods for CVE-2026-63874
Indicators of Compromise
- Kernel oops or panic traces referencing mctp_usb_rx_queue, usb_submit_urb, or rx_retry_work after interface teardown
- Unexpected use-after-free KASAN reports involving MCTP USB URB structures
- Repeated interface up/down cycles on MCTP USB devices from unprivileged sessions
Detection Strategies
- Enable KASAN and workqueue lockdep on test systems to surface racing accesses in net/mctp/usb.c
- Monitor kernel logs for stack traces originating in MCTP USB delayed work after ndo_stop
- Audit installed kernel packages against distribution advisories referencing the listed stable patch commits
Monitoring Recommendations
- Alert on kernel warnings and BUG reports emitted from the MCTP subsystem in centralized log collection
- Track unusual netlink activity that repeatedly toggles MCTP interface state from non-root contexts
- Correlate USB device connection or removal events with kernel error messages on hosts using MCTP transports
How to Mitigate CVE-2026-63874
Immediate Actions Required
- Apply the upstream Linux kernel fixes referenced by commits 54665dce982, 9c46f3ee183, and d90feaa3f74 or upgrade to a distribution kernel that has backported them
- Restrict local access to systems with MCTP over USB enabled until patches are deployed
- Inventory hosts where CONFIG_MCTP_TRANSPORT_USB is compiled in, particularly baseboard management and platform hardware
Patch Information
The fix strengthens sequencing between stop and cancel by updating ->rx_stopped and cancelling pending work atomically under a new rx_lock. Once ->rx_stopped is set and pending work is cancelled under the lock, no requeue can occur, so only killing outstanding URBs remains. Backports are available in the stable trees via Kernel Patch 54665dce982, Kernel Patch 9c46f3ee183, and Kernel Patch d90feaa3f74.
Workarounds
- Unload the mctp-usb kernel module on systems that do not require MCTP over USB transport
- Build kernels without CONFIG_MCTP_TRANSPORT_USB where the feature is not needed
- Limit CAP_NET_ADMIN and physical USB access to trusted administrators to reduce race exposure
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
