---
id: CVE-2026-43180
title: 'net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode

  kaweth_set_rx_mode(), the ndo_set_rx_mode callback, calls
  netif_stop_queue() and netif_wake_queue(…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    443a830b1dc4f85c7560da59d4494b629feee215
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    586318c2730433184c6f1d21183e346ddf25e81d
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    a2cd4b4db315a845a5603d08c9d03b11ddfc799d
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    ef9b10a020503888eb6c8ed85a3d901a624ede4c
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    9c79b839a63980c7da7ec5db895198045e154112
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    fc393af769af845d9985e2845e49553d8f015a64
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    8367c0e90126426e60581e4c07e1ec4411a0f843
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    64868f5ecadeb359a49bc4485bfa7c497047f13a
  - Linux 2.6.12
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:15:22.269207Z'
published: '2026-05-06'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:20:35.282Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43180'
references:
  - url: 'https://git.kernel.org/stable/c/443a830b1dc4f85c7560da59d4494b629feee215'
  - url: 'https://git.kernel.org/stable/c/586318c2730433184c6f1d21183e346ddf25e81d'
  - url: 'https://git.kernel.org/stable/c/a2cd4b4db315a845a5603d08c9d03b11ddfc799d'
  - url: 'https://git.kernel.org/stable/c/ef9b10a020503888eb6c8ed85a3d901a624ede4c'
  - url: 'https://git.kernel.org/stable/c/9c79b839a63980c7da7ec5db895198045e154112'
  - url: 'https://git.kernel.org/stable/c/fc393af769af845d9985e2845e49553d8f015a64'
  - url: 'https://git.kernel.org/stable/c/8367c0e90126426e60581e4c07e1ec4411a0f843'
  - url: 'https://git.kernel.org/stable/c/64868f5ecadeb359a49bc4485bfa7c497047f13a'
tags:
  - cve.org
epss: 0.00176
epssPercentile: 0.06639
ingestedAt: '2026-10-16T17:24:46.686Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode

kaweth_set_rx_mode(), the ndo_set_rx_mode callback, calls
netif_stop_queue() and netif_wake_queue(). These are TX queue flow
control functions unrelated to RX multicast configuration.

The premature netif_wake_queue() can re-enable TX while tx_urb is still
in-flight, leading to a double usb_submit_urb() on the same URB:

kaweth_start_xmit() {
    netif_stop_queue();
    usb_submit_urb(kaweth->tx_urb);
}

kaweth_set_rx_mode() {
    netif_stop_queue();
    netif_wake_queue();             // wakes TX queue before URB is done
}

kaweth_start_xmit() {
    netif_stop_queue();
    usb_submit_urb(kaweth->tx_urb); // URB submitted while active
}

This triggers the WARN in usb_submit_urb():

  "URB submitted while active"

This is a similar class of bug fixed in rtl8150 by

- commit 958baf5eaee3 ("net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast").

Also kaweth_set_rx_mode() is already functionally broken, the
real set_rx_mode action is performed by kaweth_async_set_rx_mode(),
which in turn is not a no-op only at ndo_open() time.

## Affected

- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 443a830b1dc4f85c7560da59d4494b629feee215`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 586318c2730433184c6f1d21183e346ddf25e81d`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < a2cd4b4db315a845a5603d08c9d03b11ddfc799d`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < ef9b10a020503888eb6c8ed85a3d901a624ede4c`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 9c79b839a63980c7da7ec5db895198045e154112`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < fc393af769af845d9985e2845e49553d8f015a64`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 8367c0e90126426e60581e4c07e1ec4411a0f843`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 64868f5ecadeb359a49bc4485bfa7c497047f13a`
- `Linux 2.6.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.