EUVD-2026-64365
GHSA-5prv-rfcq-7r84
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Requires physically connected AX88179 USB hardware (AV:L, PR:L) and concurrent memory pressure to trigger linearization failure (AC:H); no confidentiality or integrity impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()
When the interface has NETIF_F_SG enabled and skb_linearize() fails in ax88179_tx_fixup(), the function returns NULL without freeing the skb.
usbnet_start_xmit() treats a NULL return from tx_fixup() as a drop (info->flags does not set FLAG_MULTI_PACKET for this driver), jumping to the "drop" label where it does if (skb) dev_kfree_skb_any(skb). Because tx_fixup() returned NULL, the local skb variable in usbnet_start_xmit() is NULL, so the original skb is never freed - a memory leak on every TX frame whose linearization fails (i.e. under memory pressure).
Free the skb before returning, matching the error handling already used for the pskb_expand_head() failure path in the same function.
AnalysisAI
Memory exhaustion in the Linux kernel's ax88179_178a USB Ethernet driver allows socket buffers to leak on every failed TX linearization attempt under memory pressure. Systems with ASIX AX88179 or AX88178A USB-to-Ethernet adapters loaded with scatter-gather (NETIF_F_SG) enabled are affected: when skb_linearize() fails inside ax88179_tx_fixup(), the function returns NULL without freeing the original skb, and the caller usbnet_start_xmit() never releases it because its local skb pointer is now NULL. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three concurrent conditions are required: (1) a physical ASIX AX88179 or AX88178A USB-to-Ethernet adapter must be connected to the target system with the ax88179_178a kernel module loaded - systems without this specific hardware are entirely unaffected; (2) scatter-gather offload (NETIF_F_SG) must be enabled on the adapter's network interface, which is typically the default when the driver and hardware negotiate it but is absent if manually disabled; and (3) system memory must be sufficiently constrained to cause skb_linearize() to return a failure code during TX processing, a condition that occurs under genuine memory pressure rather than under normal operating conditions. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/A:H) materially overstates the exploitability of this issue - it is a hardware-dependent kernel memory leak that requires the specific ASIX USB adapter to be physically connected, not a remotely reachable network service. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A Linux system running an unpatched kernel with an ASIX AX88179/178A USB Ethernet adapter connected handles sustained outbound network traffic while the system is under memory pressure - for example, during a memory-exhaustion workload or aggressive OOM conditions. Each TX frame for which skb_linearize() fails inside ax88179_tx_fixup() leaks a kernel socket buffer; over time, these accumulate until available kernel memory is exhausted, triggering OOM kills or system instability. … |
| Remediation | The primary fix is to upgrade to a patched Linux kernel stable release: 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, or 7.2, selecting the branch that matches the running kernel series. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct hardware inventory to identify all systems deployed with ASIX AX88179 or AX88178A USB-to-Ethernet adapters, particularly those in high-traffic network environments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today