🇰🇷 한글 설명
Linux 커널의 kaweth USB 네트워크 드라이버에서 수신(RX) 모드 설정 함수가 송신(TX) 큐 제어 함수를 잘못 호출하여, 이미 진행 중인 USB 요청이 중복으로 제출되는 버그입니다. 이는 'URB submitted while active' 경고를 유발하며 네트워크 드라이버의 안정성을 손상시킬 수 있습니다.
💡 쉬운 설명
A Linux USB network driver incorrectly wakes up the transmit queue while a previous data transfer is still in progress, causing the same operation to be submitted twice. This can result in system warnings and potential network instability.
🇺🇸 원문 (English)
In the Linux kernel, the following vulnerability has been resolved:
net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode
kaweth_set_rx_mode(), the ndo_set_rx_mode callback, calls
netif_stop_queue() and netif_wake_queue(). These are TX queue flow
control functions unrelated to RX multicast configuration.
The premature netif_wake_queue() can re-enable TX while tx_urb is still
in-flight, leading to a double usb_submit_urb() on the same URB:
kaweth_start_xmit() {
netif_stop_queue();
usb_submit_urb(kaweth->tx_urb);
}
kaweth_set_rx_mode() {
netif_stop_queue();
netif_wake_queue(); // wakes TX queue before URB is done
}
kaweth_start_xmit() {
netif_stop_queue();
usb_submit_urb(kaweth->tx_urb); // URB submitted while active
}
This triggers the WARN in usb_submit_urb():
"URB submitted while active"
This is a similar class of bug fixed in rtl8150 by
- commit 958baf5eaee3 ("net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast").
Also kaweth_set_rx_mode() is already functionally broken, the
real set_rx_mode action is performed by kaweth_async_set_rx_mode(),
which in turn is not a no-op only at ndo_open() time.
📍 영향받는 시스템
Linux kernel systems using kaweth USB network adapters (primarily embedded systems and legacy hardware platforms)
⚔️ 공격 벡터
Local exploitation through triggering network RX mode changes while TX operations are pending on systems running vulnerable kernel versions
🛡️ 대응 방법
Update the Linux kernel to a version that includes the fix removing TX queue manipulation from the kaweth_set_rx_mode() function
🔧 검증 코드
If 'vulnerable' appears in output, the system requires kernel update; if 'driver not found' or 'check needed', verify kernel version against the patched release (2026 mid-year)
uname -r && (grep -r 'netif_wake_queue' /lib/modules/$(uname -r)/kernel/drivers/net/usb/ 2>/dev/null | grep -q kaweth && echo 'vulnerable' || echo 'check needed') || echo 'driver not found'