CVE-2026-74680

What the bug is

If cxacru_cm() encounters an error while submitting or waiting for snd_urb, it aborts and returns the error without killing the already submitted rcv_urb. This leaves the rcv_urb active. When this happens during initialization (e.g., in cxacru_atm_start()), the driver may ignore the error and proceed to call cxacru_poll_status(), which invokes cxacru_cm() again. Attempting to submit the still-active rcv_urb triggers a warning in usb_submit_urb(): cxacru 1-1:1.0: send of cm 0x84 failed (-104) ATM dev 0: cxacru_atm_start: CHIP_ADSL_LINE_START returned -104 ------------[ cut here ]------------ URB ffff88812658d200 submitted while active WARNING: drivers/usb/core/urb.c:379 at usb_submit_urb+0x79/0x18b0 drivers/usb/core/urb.c:379 ... Call Trace: <TASK> cxacru_cm+0x21a/0xf10 drivers/usb/atm/cxacru.c:631 cxacru_cm_get_array drivers/usb/atm/cxacru.c:722 [inline] cxacru_poll_status+0x178/0x1110 drivers/usb/atm/cxacru.c:828 cxacru_atm_start+0x185/0x360 drivers/usb/atm/cxacru.c:814 usbatm_atm_init+0x144/0x3a0 drivers/usb/atm/usbatm.c:927 usbatm_usb_probe+0x15cb/0x1db0 drivers/usb/atm/usbatm.c:1178 cxacru_usb_probe+0x17f/0x220 drivers/usb/atm/cxacru.c:1370 ... To fix this, ensure that rcv_urb is properly killed if cxacru_cm() aborts early. We can safely call usb_kill_urb() on rcv_urb in the error path, as it is safe to call even if the URB is not active (e.g., if it failed to submit in the first place, or if it already completed).

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

drivers/usb/atm/cxacru.c

What this is

CONEXANT ACCESSRUNNER USB DRIVERMAINTAINERS section matched on drivers/usb/atm/cxacru.c · accessrunner-general@lists.sourceforge.net · Orphan

Kernel module

none to look for. The file would have gone into cxacru, and Debian does not compile it into that module, so finding cxacru in lsmod would say nothing about this CVE.

Check it on the machine

grep -wE 'CONFIG_OF|CONFIG_PCI|CONFIG_USB|CONFIG_USB_ATM|CONFIG_USB_CXACRU|CONFIG_USB_GADGET|CONFIG_USB_PHY|CONFIG_USB_SPEEDTOUCH|CONFIG_USB_SUPPORT' /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

Show whether Debian builds this, per release

Debian does not build this code. In 5 releases below, every kernel flavour Debian publishes has the switch off, so the vulnerable file is compiled into no kernel binary Debian ships.

• bookworm, trixie, forky, sid, bookworm · linux-6.12n

n

not enabled on any flavour - this release does not build the code

Build switches

CONFIG_OF, CONFIG_PCI, CONFIG_USB, CONFIG_USB_ATM, CONFIG_USB_CXACRU, CONFIG_USB_GADGET, CONFIG_USB_PHY, CONFIG_USB_SPEEDTOUCH, CONFIG_USB_SUPPORT

Reads as

all on means the file is compiled; any one off means it is not.

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Signals

Published

2026-08-22 (2 months ago)source

CVSS

no vector published, unrated

Attack vector

not published

EPSS

0.18%, higher than 6.8% of all CVEssource

CISA KEV

not listedthe KEV catalogue

Debian urgency

not yet assignedsource

Subsystem

drivers/usb

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
2.6.13	5.10.265	6133b4610583
2.6.13	5.15.216	61093d7f1144
2.6.13	6.1.183	645d98dbccdb
2.6.13	6.6.152	993f7677949e
2.6.13	6.12.104	939b6a41f681
2.6.13	6.18.45	2f73a065791d
2.6.13	7.1.9	0af047703dbe
2.6.13	7.2	c2f811314be3

Debian advisories