Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix isochronous Ring Underrun/Overrun event handling The TRB pointer… (CVE-2025-37882)
In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix isochronous Ring Underrun/Overrun event handling The TRB pointer of these events points at enqueue at the time of error occurrence on xHCI 1.1+ HCs or it's NULL on older ones. By the time we are handling the event, a new TD may be queued at this ring position. I can trigger this race by rising interrupt moderation to increase IRQ handling delay. Similar delay may occur naturally due to system load. If this ever happens after a Missed Service Error, missed TDs will be skipped and the new TD processed as if it matched the event. It could be given back prematurely, risking data loss or buffer UAF by the xHC. Don't complete TDs on xrun events and don't warn if queued TDs don't match the event's TRB pointer, which can be NULL or a link/no-op TRB. Don't warn if there are no queued TDs at all. Now that it's safe, also handle xrun events if the skip flag is clear. This ensures completion of any TD stuck in 'error mid TD' state right before the xrun event, which could happen if a driver submits a finite number of URBs to a buggy HC and then an error occurs on the last TD.
AI Analysis
Technical Summary
This Red Hat security advisory (RHSA-2026:2759) addresses eight distinct vulnerabilities in the Linux kernel affecting Red Hat Enterprise Linux 9.6 Extended Update Support and related CodeReady Linux Builder products. The vulnerabilities include: a race condition in the xHCI driver isochronous event handling (CVE-2025-37882) that can cause data loss or use-after-free; use-after-free in eventpoll (CVE-2025-38349); data corruption and instability due to improper io_uring/net buffer handling (CVE-2025-38730); denial of service via out-of-bounds read in USB configuration parsing (CVE-2025-39760); improper verification in SMB client recv_done (CVE-2025-39933); use-after-free in proc_readdir_de() leading to privilege escalation or denial of service (CVE-2025-40271); out-of-bounds write in fbdev causing privilege escalation, information disclosure, or denial of service (CVE-2025-40304); and buffer overflow in ALSA USB audio driver causing information disclosure and denial of service (CVE-2025-40269). The advisory provides updated kernel packages to address these issues and requires rebooting the system for the fixes to take effect.
Potential Impact
The vulnerabilities collectively can lead to data loss, use-after-free conditions, data corruption, system instability, denial of service, privilege escalation, and information disclosure on affected Red Hat Enterprise Linux 9.6 Extended Update Support systems. These impacts affect core kernel components and drivers, potentially compromising system reliability and security.
Mitigation Recommendations
Red Hat has released updated kernel packages addressing these vulnerabilities for Red Hat Enterprise Linux 9.6 Extended Update Support and related products. Users should apply the available security update as detailed in the Red Hat advisory RHSA-2026:2759 and reboot affected systems to ensure the fixes take effect. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated beyond applying the official update and rebooting.
Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix isochronous Ring Underrun/Overrun event handling The TRB pointer… (CVE-2025-37882)
Description
In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix isochronous Ring Underrun/Overrun event handling The TRB pointer of these events points at enqueue at the time of error occurrence on xHCI 1.1+ HCs or it's NULL on older ones. By the time we are handling the event, a new TD may be queued at this ring position. I can trigger this race by rising interrupt moderation to increase IRQ handling delay. Similar delay may occur naturally due to system load. If this ever happens after a Missed Service Error, missed TDs will be skipped and the new TD processed as if it matched the event. It could be given back prematurely, risking data loss or buffer UAF by the xHC. Don't complete TDs on xrun events and don't warn if queued TDs don't match the event's TRB pointer, which can be NULL or a link/no-op TRB. Don't warn if there are no queued TDs at all. Now that it's safe, also handle xrun events if the skip flag is clear. This ensures completion of any TD stuck in 'error mid TD' state right before the xrun event, which could happen if a driver submits a finite number of URBs to a buggy HC and then an error occurs on the last TD.
CVSS v3.1
Score 7.8high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This Red Hat security advisory (RHSA-2026:2759) addresses eight distinct vulnerabilities in the Linux kernel affecting Red Hat Enterprise Linux 9.6 Extended Update Support and related CodeReady Linux Builder products. The vulnerabilities include: a race condition in the xHCI driver isochronous event handling (CVE-2025-37882) that can cause data loss or use-after-free; use-after-free in eventpoll (CVE-2025-38349); data corruption and instability due to improper io_uring/net buffer handling (CVE-2025-38730); denial of service via out-of-bounds read in USB configuration parsing (CVE-2025-39760); improper verification in SMB client recv_done (CVE-2025-39933); use-after-free in proc_readdir_de() leading to privilege escalation or denial of service (CVE-2025-40271); out-of-bounds write in fbdev causing privilege escalation, information disclosure, or denial of service (CVE-2025-40304); and buffer overflow in ALSA USB audio driver causing information disclosure and denial of service (CVE-2025-40269). The advisory provides updated kernel packages to address these issues and requires rebooting the system for the fixes to take effect.
Potential Impact
The vulnerabilities collectively can lead to data loss, use-after-free conditions, data corruption, system instability, denial of service, privilege escalation, and information disclosure on affected Red Hat Enterprise Linux 9.6 Extended Update Support systems. These impacts affect core kernel components and drivers, potentially compromising system reliability and security.
Mitigation Recommendations
Red Hat has released updated kernel packages addressing these vulnerabilities for Red Hat Enterprise Linux 9.6 Extended Update Support and related products. Users should apply the available security update as detailed in the Red Hat advisory RHSA-2026:2759 and reboot affected systems to ensure the fixes take effect. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated beyond applying the official update and rebooting.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:2759
- Cve Count
- 8
- Additional Cves
- ["CVE-2025-38349","CVE-2025-38730","CVE-2025-39760","CVE-2025-39933","CVE-2025-40269","CVE-2025-40271","CVE-2025-40304"]
Threat ID: 6a3da1c44853345fc181f91f
Added to database: 06/25/2026, 21:46:44 UTC
Last enriched: 07/12/2026, 10:18:46 UTC
Last updated: 09/10/2026, 19:24:56 UTC
Views: 81
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.