HIGH Introduced in 5.17
ax88179_178a TxFixup Leak
CVE-2026-74678
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
KernelScan AI5.4MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() When the interface has NETIF_F_SG enabled and skb_linearize() fails in ax88179_tx_fixup(), the function returns NULL without freeing the skb. usbnet_start_xmit() treats a NULL return from tx_fixup() as a drop (info->flags does not set FLAG_MULTI_PACKET for this driver), jumping to the "drop" label where it does `if (skb) dev_kfree_skb_any(skb)`. Because tx_fixup() returned NULL, the local skb variable in usbnet_start_xmit() is NULL, so the original skb is never freed — a memory leak on every TX frame whose linearization fails (i.e. under memory pressure). Free the skb before returning, matching the error handling already used for the pskb_expand_head() failure path in the same function.
02KernelScan AI Analysis
Risk summary
A memory leak in the ASIX AX88179/178A USB Ethernet driver's transmit path causes socket buffers to be lost whenever skb linearization fails under memory pressure. Any local user who can send traffic through the affected USB network adapter can trigger repeated leaks, potentially exhausting system memory and causing denial of service. The vulnerability requires the specific USB Ethernet hardware to be present and connected.
Vulnerability analysis
When scatter-gather is enabled on the ASIX AX88179/178A USB-to-Ethernet adapter and memory pressure prevents a transmit buffer from being flattened into contiguous memory, the driver reports failure without releasing the buffer. The networking stack only releases buffers when the transmit helper succeeds, so every failed transmission leaks memory. The fix releases the buffer before reporting failure, consistent with how the driver already handles a similar memory-allocation failure elsewhere in the same routine. Any local user who can send network traffic through the affected USB Ethernet adapter can trigger the leak; repeated failures exhaust memory and can push the system to an out-of-memory condition. The specific ASIX USB-to-Ethernet hardware must be present, and scatter-gather must be enabled, which occurs by default when large-send offload is active.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.1 | 5.17 | 6.1.183 | 83a765cbd7b4 |
| 6.6 | 5.17 | 6.6.152 | 1c63303659a2 |
| 6.18 | 5.17 | 6.18.45 | 58733b1dd46b |
| 7.1 | 5.17 | 7.1.9 | 4039cd807a5a |
| mainline | 5.17 | 7.2 | 1f428e309473 |
| 6.12 | 5.17 | 6.12.104 | 2be5091fa693 |
| cip/6.1 | 5.17 | 6.1.187-cip60 | 83a765cbd7b4 |
| cip/6.12 | 5.17 | 6.12.104-cip30 | 2be5091fa693 |