Executive brief
A vulnerability in the Linux kernel's USB networking driver could allow a local user to cause a system crash or instability. The issue occurs when the system attempts to change network settings (like the MTU) on certain USB network adapters. This can trigger internal kernel errors that disrupt network operations or lead to a complete system hang.
Technical details
A concurrency issue exists in the Linux kernel's usbnet driver within the usbnet_resume_rx() function. Syzbot identified that the code was calling smp_processor_id() while in a preemptible state, which violates kernel safety assumptions. This occurs during MTU changes (usbnet_change_mtu) when the receive queue is resumed. An attacker with local access could potentially trigger this condition to cause a Denial of Service (DoS) via kernel panic or instability. The fix involves wrapping the affected code in local_bh_disable() and local_bh_enable() to ensure it runs in a non-preemptible softirq context.
Affected products
- Linux Linux Kernel 4.7 to 6.17
Timeline
- 2025-11-12: advisory: CVE-2025-40164 published
- 2025-10-23: patched: Fix committed to stable branches
References
- https://git.kernel.org/stable/c/0134c7bff14bd50314a4f92b182850ddfc38e255
- https://git.kernel.org/stable/c/17fbad93879e87a334062882b45fa727ba1b3dd7
- https://git.kernel.org/stable/c/327cd4b68b4398b6c24f10eb2b2533ffbfc10185
- https://git.kernel.org/stable/c/65d04291adf7c59338f87aab9c6fe0bfa9993e64
- https://git.kernel.org/stable/c/6635e52bc4165793aefd686962d912d73d323afe
- https://git.kernel.org/stable/c/d1944bab8e0c1511f0cbf364aa06547735bb0ddb
- https://git.kernel.org/stable/c/f45fffae5e2549bd0a4670cc52a15ad54c9f121e