CVE-2026-63874 – net: mctp: usb: fix race between urb completion and rx_retry cancellation

CVE ID :CVE-2026-63874

Published : July 19, 2026, 3:16 p.m. | 23 minutes ago

Description :In the Linux kernel, the following vulnerability has been resolved:

net: mctp: usb: fix race between urb completion and rx_retry cancellation

It’s possible that sequencing between setting ->stopped and cancelling
the rx_retry work (in ndo_stop) could leave us with an urb queued:

T1: ndo_stop T2: rx_retry_work
———— —————-
LD: ->stopped => false
ST: ->stopped rx_stopped, and cancelling pending work, we know that the
requeue cannot occur, so all that’s left is killing any pending urb.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…