Bug 2521451 (CVE-2026-74678)

Summary: CVE-2026-74678 kernel: net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's ax88179_178a USB network driver. When the network interface has scatter-gather (SG) enabled and a packet linearization operation fails, the system fails to free the associated memory buffer. This oversight leads to a memory leak, which could be exploited by an attacker to cause a denial of service by exhausting system resources.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-22 15:46:14 UTC 
In the Linux kernel, the following vulnerability has been resolved:

net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()

When the interface has NETIF_F_SG enabled and skb_linearize() fails in
ax88179_tx_fixup(), the function returns NULL without freeing the skb.

usbnet_start_xmit() treats a NULL return from tx_fixup() as a drop
(info->flags does not set FLAG_MULTI_PACKET for this driver), jumping
to the "drop" label where it does `if (skb) dev_kfree_skb_any(skb)`.
Because tx_fixup() returned NULL, the local skb variable in
usbnet_start_xmit() is NULL, so the original skb is never freed — a
memory leak on every TX frame whose linearization fails (i.e. under
memory pressure).

Free the skb before returning, matching the error handling already used
for the pskb_expand_head() failure path in the same function.
Comment 1 Keith Grant 2026-08-24 16:32:21 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026082231-CVE-2026-74678-e009@gregkh/T