Threats Tagged 'cve-2025-40140'

A high-severity vulnerability in the Linux kernel's USB network driver for the rtl8150 device was resolved. The issue involved improper synchronization in the rtl8150_set_multicast function, which incorrectly called netif_stop_queue and netif_wake_queue, leading to potential double submission of USB requests. This could cause disruptions in the transmit queue handling. The fix removes these disruptive calls, relying on the net core function dev_set_rx_mode for proper synchronization.

In the Linux kernel, the following vulnerability has been resolved: net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb. This is the sequence of events that leads to the warning: rtl8150_start_xmit() { netif_stop_queue(); usb_submit_urb(dev->tx_urb); } rtl8150_set_multicast() { netif_stop_queue(); netif_wake_queue(); <-- wakes up TX queue before URB is done } rtl8150_start_xmit() { netif_stop_queue(); usb_submit_urb(dev->tx_urb); <-- double submission } rtl8150_set_multicast being the ndo_set_rx_mode callback should not be calling netif_stop_queue and notif_start_queue as these handle TX queue synchronization. The net core function dev_set_rx_mode handles the synchronization for rtl8150_set_multicast making it safe to remove these locks.