CVE-2026-74677: Linux Kernel USB ipheth Use-After-Free

CVE-2026-74677 Overview

CVE-2026-74677 is a use-after-free vulnerability in the Linux kernel ipheth USB driver, which provides tethering support for Apple iPhone devices. The flaw resides in the ipheth_sndbulk_callback() function, which re-arms a delayed carrier-check work item on any non-zero URB status without checking whether the network interface is still up. When the device is unplugged or the interface is brought down with a TX URB in flight, the work item can outlive the netdev, causing ipheth_carrier_check_work() to dereference freed memory.

Critical Impact
A physically attached USB device that stops draining bulk OUT traffic combined with a link-down and unplug sequence can trigger a slab-use-after-free in kernel memory, reproducible under KASAN.

Affected Products

Linux kernel net/usb/ipheth driver
Linux-next tree at tag next-20260731 (confirmed reproducer)
Stable kernel branches referenced by fix commits 2c74961, 48303f3, d07133f, and fde39b8

Discovery Timeline

Reported by 0sec (0sec.ai)
2026-08-22 - CVE-2026-74677 published to NVD
2026-08-22 - Last updated in NVD database

Technical Details for CVE-2026-74677

Vulnerability Analysis

The ipheth driver embeds a carrier_work delayed work item inside the netdev private area. The bulk send completion handler ipheth_sndbulk_callback() unconditionally schedules this work whenever it observes a non-zero URB status. The scheduling logic is not tied to interface state, so completions that arrive after ipheth_close() has drained the work can re-arm it.

On unplug with an in-flight TX URB, ipheth_disconnect() first drains work through unregister_netdev() -> ipheth_close() -> cancel_delayed_work_sync(), then calls ipheth_kill_urbs(). The usb_kill_urb() call completes the pending TX URB with -ENOENT, which triggers ipheth_sndbulk_callback() after the drain and re-arms carrier_work. Subsequently, free_netdev() releases the netdev while the work is still pending, and ipheth_carrier_check_work() later runs against freed memory.

A second path exists when the interface is administratively brought down with a TX URB in flight. unregister_netdev() does not invoke ipheth_close() for an already-down interface, so nothing drains the re-armed work before disconnect, and ipheth_carrier_check_work() re-queues itself once per second until free.

Root Cause

The root cause is missing state coupling between the URB completion path and the interface up/down lifecycle. The completion callback schedules a delayed work item that assumes the netdev remains valid, but neither ipheth_close() nor ipheth_disconnect() fully quiesces the scheduling source. This is classified as a Use After Free issue in kernel work-queue lifetime management.

Attack Vector

Triggering the bug requires an attached USB device that stops draining bulk OUT transfers, followed by a link-down and unplug driven by root. The vulnerability does not cross a privilege boundary, and the upstream reporter states that no exploit primitive was developed. Reproduction on linux-next with dummy_hcd and raw-gadget reported a slab-use-after-free in __run_timers() in 15 of 15 unpatched boots and 0 of 15 patched boots.

See the upstream fix commits for technical details: Kernel Git Commit 2c74961, Kernel Git Commit 48303f3, Kernel Git Commit d07133f, and Kernel Git Commit fde39b8.

Detection Methods for CVE-2026-74677

Indicators of Compromise

KASAN reports naming slab-use-after-free in __run_timers with the freeing stack pointing to ipheth_disconnect and the re-arm stack pointing to ipheth_sndbulk_callback via queue_delayed_work_on().
Kernel oops or general protection fault after USB disconnect events on hosts using iPhone USB tethering.
Repeated ipheth_carrier_check_work scheduling entries after the associated interface is administratively down.

Detection Strategies

Enable KASAN on test kernels used for USB driver validation to surface use-after-free conditions before deployment.
Correlate kern.log or journald kernel warnings referencing ipheth with USB hotplug events tracked through udev.
Monitor for unexpected netdev free-time warnings tied to delayed work items in kernel telemetry pipelines.

Monitoring Recommendations

Forward kernel logs to a centralized data lake and alert on ipheth module strings paired with use-after-free or BUG: markers.
Track USB device attach and detach events on endpoints that use Apple tethering, particularly where devices may stall bulk OUT traffic.
Baseline kernel version deployment across the fleet and flag hosts running affected linux-next or unpatched stable branches.

How to Mitigate CVE-2026-74677

Immediate Actions Required

Apply the upstream fix that ties carrier_work to interface state, enabling it in ipheth_open() and disabling it in ipheth_close() via disable_delayed_work_sync().
Rebuild and redeploy kernels from stable branches that include commits 2c74961, 48303f3, d07133f, or fde39b8.
Restrict physical USB access on systems where kernel integrity is a priority until patched kernels are in place.

Patch Information

The fix disables the carrier_work item during ipheth_probe() so enable and disable counts balance from the first open. ipheth_open() enables the work, ipheth_close() disables and waits for any running instance, and schedule_delayed_work() from the URB completion becomes a no-op whenever the interface is not up. Refer to the stable commits listed above for the exact patch content.

Workarounds

Unload the ipheth module on hosts that do not require iPhone USB tethering using modprobe -r ipheth, and blacklist it to prevent auto-load.
Avoid unplugging tethered iPhones while the interface is administratively down, as this path most reliably triggers the free.
On multi-user systems, limit root-level USB manipulation to reduce the operational conditions under which the race can occur.

bash

# Blacklist the ipheth module until a patched kernel is installed
echo "blacklist ipheth" | sudo tee /etc/modprobe.d/blacklist-ipheth.conf
sudo modprobe -r ipheth
sudo update-initramfs -u