CVE-2026-63874 addresses a race condition in the Linux kernel's MCTP USB network driver where the sequencing between setting the stopped state and cancelling the rx_retry work was flawed. This could result in a USB request block (URB) remaining queued after the network device was stopped, allowing the URB completion handler to reschedule the retry work unexpectedly. The fix introduces a new rx lock to atomically update the stopped state and cancel pending work, preventing requeueing and ensuring proper cleanup of pending URBs.

The vulnerability could cause unexpected behavior in the MCTP USB network driver due to race conditions, potentially leading to resource mismanagement or instability in the affected kernel component. No specific exploit or broader impact such as privilege escalation or denial of service is described.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The description indicates the issue has been resolved in the Linux kernel, so applying the relevant kernel updates when available is recommended.