Skip to main content

Linux Kernel EUVDEUVD-2026-38975

| CVE-2026-53107 MEDIUM
2026-06-24 Linux GHSA-2h5x-857c-q5qg
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local low-privilege access sufficient to trigger TX traffic; pure kernel-crash availability impact with no confidentiality or integrity effect; AC:L as condition arises during normal driver operation.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 23, 2026 - 21:45 vuln.today
CVSS changed
Jul 23, 2026 - 21:38 NVD
5.5 (MEDIUM)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 nvd
MEDIUM 5.5
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

wifi: libertas: don't kill URBs in interrupt context

Serialization for the TX path was enforced by calling usb_kill_urb()/usb_kill_anchored_urbs(), to prevent transmission before a previous URB was completed. usb_tx_block() can be called from interrupt context (e.g. in the HCD giveback path), so we can't always use it to kill in-flight URBs.

Prevent sleeping during interrupt context by checking the tx_submitted anchor for existing URBs. We now return -EBUSY, to indicate there's a pending request.

AnalysisAI

The Marvell Libertas USB WiFi driver in the Linux kernel invokes usb_kill_urb() and usb_kill_anchored_urbs() from interrupt context during the HCD giveback path, causing a kernel BUG() or deadlock because those functions may sleep. Systems with a Marvell Libertas USB WiFi adapter attached can be crashed by a local low-privileged user triggering the race condition, resulting in a denial of service via kernel panic. No public exploit exists and EPSS is 0.15% (5th percentile), indicating negligible exploitation probability; the constraint to specific legacy hardware further limits real-world impact.

Technical ContextAI

The libertas USB driver (drivers/net/wireless/marvell/libertas) manages Marvell Libertas chipset-based USB WiFi adapters. TX path serialization was enforced by calling usb_kill_urb() and usb_kill_anchored_urbs() to prevent concurrent USB Request Block submissions. These functions internally wait for in-flight URBs to complete, which requires sleeping - a forbidden operation in atomic/interrupt context. The HCD (Host Controller Driver) giveback path runs in interrupt context and can invoke usb_tx_block(), which previously triggered the sleeping kill functions, violating the kernel's no-sleep-in-atomic rule and causing a BUG_ON() or deadlock. The fix replaces the kill pattern with a non-sleeping poll of the tx_submitted anchor, returning -EBUSY when a URB is outstanding. Affected CPE is cpe:2.3:a:linux:linux across multiple stable branches. No CWE is formally assigned, but the root cause maps to CWE-662 (Improper Synchronization) or CWE-119-class misuse of a blocking API in an atomic section.

RemediationAI

Upgrade to a patched Linux kernel version. Confirmed fixed versions per EUVD include 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.33, 6.19.6, 7.0.10, and 7.1. Stable-tree patches are available at https://git.kernel.org/stable/c/00c0317cebf44151df18fb647781f315268cdd98, https://git.kernel.org/stable/c/4f273d3f98ebc60c30bbfb3ed4a7f0477d3eaed2, and https://git.kernel.org/stable/c/7c5c2b661bdb78c1472b8833265c9ed1ee880039. Ubuntu users should apply updates referenced in USN-8568-1 and USN-8566-1. As a compensating control on systems that cannot be patched immediately, blacklisting the libertas_usb kernel module eliminates the attack surface entirely: add 'blacklist libertas_usb' to /etc/modprobe.d/blacklist.conf and reboot. The trade-off is complete loss of WiFi connectivity on any Marvell Libertas USB adapter. Systems without such hardware are unaffected and require no action.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-38975 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy