CVE-2026-74678: Linux Kernel USB Network Driver Leak Bug

CVE-2026-74678 Overview

CVE-2026-74678 is a memory leak vulnerability in the Linux kernel's ax88179_178a USB Ethernet driver. The flaw resides in ax88179_tx_fixup(), which fails to free the socket buffer (skb) when skb_linearize() fails on interfaces with NETIF_F_SG (scatter-gather) enabled. Each failed transmit under memory pressure leaks the original skb, progressively exhausting kernel memory and degrading system availability.

Critical Impact
Repeated linearization failures on ax88179/178a USB Ethernet adapters can exhaust kernel memory, resulting in denial of service on affected Linux systems.

Affected Products

Linux kernel builds including the drivers/net/usb/ax88179_178a.c USB Ethernet driver
Systems using ASIX AX88179/AX88178A USB 3.0 Gigabit Ethernet adapters
Distributions shipping vulnerable stable kernel branches prior to the referenced fix commits

Discovery Timeline

2026-08-22 - CVE-2026-74678 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74678

Vulnerability Analysis

The defect is a Memory Leak in the ASIX AX88179/178A USB Ethernet driver's transmit path. When an interface advertises NETIF_F_SG, the driver may need to linearize a paged skb before writing driver-specific headers. If skb_linearize() returns an error, ax88179_tx_fixup() returns NULL without invoking dev_kfree_skb_any() on the original buffer.

The caller, usbnet_start_xmit(), interprets a NULL return as a drop condition because info->flags does not set FLAG_MULTI_PACKET for this driver. Control transfers to the drop label, which executes if (skb) dev_kfree_skb_any(skb). However, the local skb variable in usbnet_start_xmit() has already been reassigned to the NULL value returned by tx_fixup(), so the original buffer is never released. Every TX frame whose linearization fails leaks memory.

Root Cause

The root cause is inconsistent error handling inside ax88179_tx_fixup(). The existing failure path for pskb_expand_head() correctly frees the skb before returning NULL, but the skb_linearize() failure branch does not. The fix aligns the two paths by calling dev_kfree_skb_any(skb) prior to returning NULL.

Attack Vector

The attack vector is network-based and does not require privileges or user interaction. An attacker able to induce sustained memory pressure on the host, combined with heavy TX traffic across an ax88179/178A adapter using scatter-gather, can trigger repeated linearization failures. Each failure leaks a full skb, driving the system toward memory exhaustion and denial of service.

No verified public exploit code is available. Refer to the upstream commits, including Kernel Git Commit 1c63303 and Kernel Git Commit 83a765c, for the exact patch diff.

Detection Methods for CVE-2026-74678

Indicators of Compromise

Progressive growth of kernel SReclaimable and skbuff_head_cache slab counters in /proc/slabinfo on hosts using ax88179/178A adapters.
Rising tx_dropped or tx_errors counters on interfaces backed by the ax88179_178a driver during memory pressure.
Out-of-memory (OOM) killer activations correlated with sustained transmit workloads on USB Ethernet interfaces.

Detection Strategies

Monitor kernel slab allocations for skbuff_head_cache and skbuff_fclone_cache growth without corresponding network throughput increases.
Correlate dmesg entries referencing ax88179_178a with MemAvailable decline over time.
Inventory endpoints and servers using ASIX USB Ethernet adapters to scope exposure to the vulnerable driver.

Monitoring Recommendations

Ingest /proc/meminfo, /proc/slabinfo, and ethtool -S counters into centralized telemetry for trend analysis.
Alert on sustained downward trends in MemFree on Linux hosts with USB Ethernet uplinks.
Track kernel version and loaded module inventory across the fleet to identify unpatched systems.

How to Mitigate CVE-2026-74678

Immediate Actions Required

Apply the upstream stable kernel updates that include the ax88179_tx_fixup() fix and reboot affected hosts.
Identify hosts loading the ax88179_178a module and prioritize them for patching, especially servers and workstations exposed to untrusted network load.
For systems that cannot be patched immediately, disable scatter-gather on the affected interface to bypass the vulnerable code path.

Patch Information

The fix frees the skb before returning NULL from ax88179_tx_fixup() when skb_linearize() fails, matching the existing pskb_expand_head() error handling. The patch is available across multiple stable branches, including Kernel Git Commit 1f428e3, Kernel Git Commit 2be5091, Kernel Git Commit 4039cd8, and Kernel Git Commit 58733b1.

Workarounds

Disable scatter-gather on the interface with ethtool -K <iface> sg off to avoid the linearization path.
Unload the ax88179_178a module on hosts that do not require the adapter using modprobe -r ax88179_178a.
Replace ASIX USB Ethernet adapters with alternative NICs on high-throughput or memory-constrained systems until patches are applied.

bash

# Disable scatter-gather on the affected interface as a temporary workaround
sudo ethtool -K eth1 sg off

# Verify the setting
ethtool -k eth1 | grep scatter-gather

# Optionally unload the driver if the adapter is not required
sudo modprobe -r ax88179_178a