CVE-2026-74677: net: usb: ipheth: fix carrier_work UAF on disconnect

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: usb: ipheth: fix carrier_work UAF on disconnect

ipheth_sndbulk_callback() re-arms the carrier-check work on any
non-zero URB status:

	else
		schedule_delayed_work(&dev->carrier_work, 0);

Nothing ties that to the interface being up, so the work can be armed
again after ipheth_close() has already drained it, and stay armed
until the netdev whose private area embeds it is freed.

On unplug with a TX URB in flight, ipheth_disconnect() drains the work
through unregister_netdev() -> ipheth_close() ->
cancel_delayed_work_sync() and only then calls ipheth_kill_urbs().
usb_kill_urb() completes the in-flight TX URB with -ENOENT, so
ipheth_sndbulk_callback() runs after the drain and re-arms
carrier_work.

The same completion also re-arms the work if the interface is only
brought down while a TX URB is in flight, and
ipheth_carrier_check_work() then keeps re-queueing itself once a
second. unregister_netdev() does not call ipheth_close() for an
already-down interface, so nothing drains it on the later unplug
either.

In both cases free_netdev() frees the netdev while carrier_work is
still pending, and ipheth_carrier_check_work() dereferences freed
memory.

Tie the work to the interface state instead of chasing the completion:
disable it in ipheth_close() and enable it in ipheth_open(), so a
schedule_delayed_work() from the URB completion is a no-op whenever
the interface is not up. disable_delayed_work_sync() also waits for a
running instance, so it fully replaces the cancel_delayed_work_sync()
it takes the place of. The work starts out disabled in ipheth_probe()
so the enable/disable counts balance from the first open.

Reproduced under KASAN on linux-next (next-20260731) with dummy_hcd and
raw-gadget standing in for the device, driving the second path above (the
interface is already down, so unregister_netdev() does not call
ipheth_close()): 15 of 15 unpatched boots report a slab-use-after-free in
__run_timers(), freed by ipheth_disconnect() and re-armed from
ipheth_sndbulk_callback() via queue_delayed_work_on(). The
same trigger on a kernel differing only by this patch reports 0 of 15,
and the carrier check still functions across open/close cycles.

The reproducer needs an attached USB device that stops draining bulk OUT,
plus a link down and unplug, driven as root. It is not a privilege
boundary crossing and no exploit primitive was developed.

Found by 0sec (https://0sec.ai).

The Linux kernel CVE team has assigned CVE-2026-74677 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.15 with commit bb1b40c7cb863f0800a6410c7dcb86cf3f28d3b1 and fixed in 6.12.104 with commit d07133fe1befae9a1e4c4c5e46ef0b73d2992020
	Issue introduced in 4.15 with commit bb1b40c7cb863f0800a6410c7dcb86cf3f28d3b1 and fixed in 6.18.45 with commit 2c7496124e94c7f9c3daa5c5b1fb563ca9d62c45
	Issue introduced in 4.15 with commit bb1b40c7cb863f0800a6410c7dcb86cf3f28d3b1 and fixed in 7.1.9 with commit 48303f3ae0fa6e102f3fc7dbf1688cc179131962
	Issue introduced in 4.15 with commit bb1b40c7cb863f0800a6410c7dcb86cf3f28d3b1 and fixed in 7.2 with commit fde39b8a521780391fb4e5bda2c0aa4928947f12
	Issue introduced in 4.4.180 with commit 4f2df9fd07698bece3321fbf9e4b6dbcb9babccc
	Issue introduced in 4.9.173 with commit ea7d6be58c2e6c1f426b48994bb22b2393c90963
	Issue introduced in 4.14.116 with commit f5bca75dc46701f4c0d1dcbaae401233ae7ff06b

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74677
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/usb/ipheth.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/d07133fe1befae9a1e4c4c5e46ef0b73d2992020
	https://git.kernel.org/stable/c/2c7496124e94c7f9c3daa5c5b1fb563ca9d62c45
	https://git.kernel.org/stable/c/48303f3ae0fa6e102f3fc7dbf1688cc179131962
	https://git.kernel.org/stable/c/fde39b8a521780391fb4e5bda2c0aa4928947f12