CVE-2026-74680: Linux Kernel USB ATM Use-After-Free Vulnerability

CVE-2026-74680 Overview

CVE-2026-74680 is a Linux kernel vulnerability in the cxacru USB ATM driver. The flaw resides in the cxacru_cm() function inside drivers/usb/atm/cxacru.c. When cxacru_cm() encounters an error while submitting or waiting for snd_urb, it returns the error without killing the already submitted rcv_urb. The active URB is later resubmitted during initialization through cxacru_poll_status(), triggering a usb_submit_urb() warning. The condition affects driver initialization paths reached during USB device probe.

Critical Impact
Improper URB lifecycle handling in the cxacru driver produces kernel warnings and unstable USB ATM device state during initialization on affected Linux kernel builds.

Affected Products

Linux kernel drivers/usb/atm/cxacru.c (cxacru USB ATM driver)
Systems using Conexant AccessRunner USB ADSL modems
Multiple stable Linux kernel branches receiving backport fixes

Discovery Timeline

2026-08-22 - CVE-2026-74680 published to NVD
2026-08-22 - Last updated in NVD database

Technical Details for CVE-2026-74680

Vulnerability Analysis

The cxacru driver manages Conexant AccessRunner USB ADSL modems and uses paired USB Request Blocks (URBs) for command messaging. The cxacru_cm() function submits a receive URB (rcv_urb) before submitting the send URB (snd_urb) and waiting for completion. If submission of snd_urb fails, or the wait returns an error, the function returns without invoking usb_kill_urb() on rcv_urb.

The receive URB remains active in the USB core. During initialization through cxacru_atm_start(), the driver ignores the returned error and proceeds to call cxacru_poll_status(). That path calls cxacru_cm() again, which attempts to submit the still-active rcv_urb. The USB core detects the reuse and emits a WARNING from usb_submit_urb() at drivers/usb/core/urb.c:379, printing "URB submitted while active".

Root Cause

The root cause is incomplete error-path cleanup in cxacru_cm(). The function does not kill rcv_urb when it aborts after the receive URB has already been queued. The defect is a resource lifecycle bug in kernel driver code and is classified as a Kernel Vulnerability related to improper resource cleanup.

Attack Vector

The issue is triggered locally through USB device probe and initialization. Exploitation requires attachment of a matching USB ATM device or a crafted USB descriptor that causes the initial cxacru_cm() invocation to fail. No network attack vector is documented. The primary observable effect is a kernel warning and inconsistent driver state during startup.

No verified exploit code is available. See the referenced kernel commits for technical details of the fix.

Detection Methods for CVE-2026-74680

Indicators of Compromise

Kernel log entries containing cxacru and send of cm 0x84 failed (-104)
Kernel warning URB <addr> submitted while active from drivers/usb/core/urb.c:379
Stack traces referencing cxacru_cm, cxacru_poll_status, or cxacru_atm_start

Detection Strategies

Query system logs and dmesg output for cxacru driver warnings during USB device attach events.
Correlate USB device probe timestamps with kernel WARN traces referencing usb_submit_urb.
Track kernel package versions across the fleet and flag hosts running kernels without the referenced stable commits.

Monitoring Recommendations

Forward kernel logs to a centralized logging system and alert on WARNING: drivers/usb/core/urb.c events.
Monitor USB device attachment on systems that do not require USB ATM hardware and generate alerts on unexpected cxacru probe activity.
Include kernel version and applied patch levels in host inventory reports to identify unpatched systems.

How to Mitigate CVE-2026-74680

Immediate Actions Required

Apply the upstream Linux kernel fix that calls usb_kill_urb(rcv_urb) in the cxacru_cm() error path.
Update to a stable kernel release containing one of the referenced commits from kernel.org.
Restrict physical USB access on systems where cxacru hardware is not required.

Patch Information

The fix ensures rcv_urb is killed when cxacru_cm() aborts early. usb_kill_urb() is safe to call on URBs that failed to submit or already completed. The patch is available in multiple stable branches through the following commits: Kernel Git Commit 0af0477, Kernel Git Commit 2f73a06, Kernel Git Commit 61093d7, Kernel Git Commit 6133b46, Kernel Git Commit 645d98d, Kernel Git Commit 939b6a4, Kernel Git Commit 993f767, and Kernel Git Commit c2f8113.

Workarounds

Blacklist the cxacru kernel module on systems that do not use Conexant AccessRunner USB ADSL hardware.
Enforce USB device authorization policies to prevent unauthorized ATM modem attachment.
Disable loading of legacy USB ATM drivers in build configurations for hardened kernel images.

bash

# Blacklist the cxacru module on systems that do not require it
echo "blacklist cxacru" | sudo tee /etc/modprobe.d/blacklist-cxacru.conf
sudo depmod -a
sudo update-initramfs -u