CVE-2026-74678: net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()

When the interface has NETIF_F_SG enabled and skb_linearize() fails in
ax88179_tx_fixup(), the function returns NULL without freeing the skb.

usbnet_start_xmit() treats a NULL return from tx_fixup() as a drop
(info->flags does not set FLAG_MULTI_PACKET for this driver), jumping
to the "drop" label where it does `if (skb) dev_kfree_skb_any(skb)`.
Because tx_fixup() returned NULL, the local skb variable in
usbnet_start_xmit() is NULL, so the original skb is never freed — a
memory leak on every TX frame whose linearization fails (i.e. under
memory pressure).

Free the skb before returning, matching the error handling already used
for the pskb_expand_head() failure path in the same function.

The Linux kernel CVE team has assigned CVE-2026-74678 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.17 with commit 16b1c4e01c89ba07367461e0bc4cb84993c2d027 and fixed in 6.1.183 with commit 83a765cbd7b4d11b0b9fa1bb9d941ae911a2159b
	Issue introduced in 5.17 with commit 16b1c4e01c89ba07367461e0bc4cb84993c2d027 and fixed in 6.6.152 with commit 1c63303659a2264bd55d9813df74cb4caeed5922
	Issue introduced in 5.17 with commit 16b1c4e01c89ba07367461e0bc4cb84993c2d027 and fixed in 6.12.104 with commit 2be5091fa693b9119ad25a8bb8c149d236a23ade
	Issue introduced in 5.17 with commit 16b1c4e01c89ba07367461e0bc4cb84993c2d027 and fixed in 6.18.45 with commit 58733b1dd46bb231d9d279c132a20ee46da1b664
	Issue introduced in 5.17 with commit 16b1c4e01c89ba07367461e0bc4cb84993c2d027 and fixed in 7.1.9 with commit 4039cd807a5a46dc5f7618fffae926b8ad8455eb
	Issue introduced in 5.17 with commit 16b1c4e01c89ba07367461e0bc4cb84993c2d027 and fixed in 7.2 with commit 1f428e30947395d9b9aacee03e25a4e6cfcad7a4

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74678
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/usb/ax88179_178a.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/83a765cbd7b4d11b0b9fa1bb9d941ae911a2159b
	https://git.kernel.org/stable/c/1c63303659a2264bd55d9813df74cb4caeed5922
	https://git.kernel.org/stable/c/2be5091fa693b9119ad25a8bb8c149d236a23ade
	https://git.kernel.org/stable/c/58733b1dd46bb231d9d279c132a20ee46da1b664
	https://git.kernel.org/stable/c/4039cd807a5a46dc5f7618fffae926b8ad8455eb
	https://git.kernel.org/stable/c/1f428e30947395d9b9aacee03e25a4e6cfcad7a4