Executive brief
The Linux kernel's USB ATM driver (cxacru) fails to properly clean up a USB receive request (rcv_urb) when an error occurs during command submission. This can leave the request active in memory, causing system warnings and potential instability if the driver attempts to reuse the same request. The issue manifests during device initialization when errors occur.
Technical details
A resource cleanup bug exists in the cxacru_cm() function in drivers/usb/atm/cxacru.c. When snd_urb submission or wait operations fail, the function returns early without killing the already-submitted rcv_urb, leaving it active. On subsequent calls to cxacru_cm() (e.g., from cxacru_poll_status() during initialization), attempting to resubmit the active rcv_urb triggers a kernel warning in usb_submit_urb(). The fix is to call usb_kill_urb() on rcv_urb in the error path, which safely terminates the URB regardless of its current state. No authentication or network access is required; this is a kernel-level resource management issue affecting USB ATM device initialization.
Affected products
- Linux Linux kernel unspecified
Timeline
- 2026-08-22: disclosed