CVE-2026-74680

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()

If cxacru_cm() encounters an error while submitting or waiting for snd_urb,

it aborts and returns the error without killing the already submitted

rcv_urb. This leaves the rcv_urb active.

When this happens during initialization (e.g., in cxacru_atm_start()), the

driver may ignore the error and proceed to call cxacru_poll_status(), which

invokes cxacru_cm() again. Attempting to submit the still-active rcv_urb

triggers a warning in usb_submit_urb():

cxacru 1-1:1.0: send of cm 0x84 failed (-104)

ATM dev 0: cxacru_atm_start: CHIP_ADSL_LINE_START returned -104

------------[ cut here ]------------

URB ffff88812658d200 submitted while active

WARNING: drivers/usb/core/urb.c:379 at usb_submit_urb+0x79/0x18b0

drivers/usb/core/urb.c:379

...

Call Trace:

<TASK>

cxacru_cm+0x21a/0xf10 drivers/usb/atm/cxacru.c:631

cxacru_cm_get_array drivers/usb/atm/cxacru.c:722 [in

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References