In the Linux kernel, the following vulnerability has been resolved: net: mctp: usb: fix race between urb completion and rx_retry cancellation It's… (CVE-2026-63874)
In the Linux kernel, the following vulnerability has been resolved: net: mctp: usb: fix race between urb completion and rx_retry cancellation It's possible that sequencing between setting ->stopped and cancelling the rx_retry work (in ndo_stop) could leave us with an urb queued: T1: ndo_stop T2: rx_retry_work ------------ ---------------- LD: ->stopped => false ST: ->stopped <= true usb_kill_urb() mctp_usb_rx_queue() usb_submit_urb() cancel_delayed_work_sync() That urb completion can then re-schedule rx_retry_work. Strenghen the sequencing between the stop (preventing another requeue) and the cancel by updating both atomically under a new rx lock. After setting ->rx_stopped, and cancelling pending work, we know that the requeue cannot occur, so all that's left is killing any pending urb.
AI Analysis
Technical Summary
CVE-2026-63874 addresses a race condition in the Linux kernel's MCTP USB network driver where the sequencing between setting the stopped state and cancelling the rx_retry work was flawed. This could result in a USB request block (URB) remaining queued after the network device was stopped, allowing the URB completion handler to reschedule the retry work unexpectedly. The fix introduces a new rx lock to atomically update the stopped state and cancel pending work, preventing requeueing and ensuring proper cleanup of pending URBs.
Potential Impact
The vulnerability could cause unexpected behavior in the MCTP USB network driver due to race conditions, potentially leading to resource mismanagement or instability in the affected kernel component. No specific exploit or broader impact such as privilege escalation or denial of service is described.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The description indicates the issue has been resolved in the Linux kernel, so applying the relevant kernel updates when available is recommended.
In the Linux kernel, the following vulnerability has been resolved: net: mctp: usb: fix race between urb completion and rx_retry cancellation It's… (CVE-2026-63874)
Description
In the Linux kernel, the following vulnerability has been resolved: net: mctp: usb: fix race between urb completion and rx_retry cancellation It's possible that sequencing between setting ->stopped and cancelling the rx_retry work (in ndo_stop) could leave us with an urb queued: T1: ndo_stop T2: rx_retry_work ------------ ---------------- LD: ->stopped => false ST: ->stopped <= true usb_kill_urb() mctp_usb_rx_queue() usb_submit_urb() cancel_delayed_work_sync() That urb completion can then re-schedule rx_retry_work. Strenghen the sequencing between the stop (preventing another requeue) and the cancel by updating both atomically under a new rx lock. After setting ->rx_stopped, and cancelling pending work, we know that the requeue cannot occur, so all that's left is killing any pending urb.
CVSS v3.1
Score 7.8high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-63874 addresses a race condition in the Linux kernel's MCTP USB network driver where the sequencing between setting the stopped state and cancelling the rx_retry work was flawed. This could result in a USB request block (URB) remaining queued after the network device was stopped, allowing the URB completion handler to reschedule the retry work unexpectedly. The fix introduces a new rx lock to atomically update the stopped state and cancel pending work, preventing requeueing and ensuring proper cleanup of pending URBs.
Potential Impact
The vulnerability could cause unexpected behavior in the MCTP USB network driver due to race conditions, potentially leading to resource mismanagement or instability in the affected kernel component. No specific exploit or broader impact such as privilege escalation or denial of service is described.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The description indicates the issue has been resolved in the Linux kernel, so applying the relevant kernel updates when available is recommended.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-4gv8-vfvf-62f2
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-63874"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- 3.1
Threat ID: 6a5d27ac2a4a8d5989130629
Added to database: 07/19/2026, 19:38:20 UTC
Last enriched: 07/19/2026, 20:14:25 UTC
Last updated: 08/26/2026, 18:04:39 UTC
Views: 51
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.