CVE-2026-43180 net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode
A race condition in the Linux kernel kaweth USB driver allows double submission of a URB, potentially causing a kernel warning or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43180?
CVE-2026-43180 is a high-severity vulnerability in Linux kernel, published on 6 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode
kaweth_set_rx_mode(), the ndo_set_rx_mode callback, calls netif_stop_queue() and netif_wake_queue(). These are TX queue flow control functions unrelated to RX multicast configuration.
The premature netif_wake_queue() can re-enable TX while tx_urb is still in-flight, leading to a double usb_submit_urb() on the same URB:
kaweth_start_xmit() { netif_stop_queue(); usb_submit_urb(kaweth->tx_urb); }
kaweth_set_rx_mode() { netif_stop_queue(); netif_wake_queue(); // wakes TX queue before URB is done }
kaweth_start_xmit() { netif_stop_queue(); usb_submit_urb(kaweth->tx_urb); // URB submitted while active }
This triggers the WARN in usb_submit_urb():
"URB submitted while active"
This is a similar class of bug fixed in rtl8150 by
- commit 958baf5eaee3 ("net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast").
Also kaweth_set_rx_mode() is already functionally broken, the real set_rx_mode action is performed by kaweth_async_set_rx_mode(), which in turn is not a no-op only at ndo_open() time.
Weakness: CWE-362
Which versions are affected by CVE-2026-43180?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43180?
Apply the vendor's patch.
Is CVE-2026-43180 being exploited?
There is no known exploitation of CVE-2026-43180 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43180, DEBIAN-CVE-2026-43180, GHSA-gq4c-7253-q3cg, ROOT-OS-DEBIAN-11-CVE-2026-43180, ROOT-OS-UBUNTU-2204-CVE-2026-43180, ROOT-OS-UBUNTU-2404-CVE-2026-43180 and 1 more.