CVE-2026-74680

A flaw was found in the Linux kernel's cxacru USB ATM driver. When the cxacru_cm() function encounters an error, it fails to properly terminate an already submitted receive USB Request Block (URB). This oversight can lead to the driver attempting to resubmit an active URB, which triggers a warning in the usb_submit_urb() function. This issue may result in system instability or unexpected behavior.

A low impact flaw was found in the Linux kernel cxacru USB ADSL ATM driver. When the cxacru_cm() function encounters an error while submitting or waiting for the send URB, it returns without killing the already submitted receive URB (rcv_urb). If the error is ignored during device initialization and cxacru_cm() is invoked again (for example via cxacru_poll_status()), the still-active receive URB is resubmitted, which triggers a WARNING in usb_submit_urb(). Triggering this flaw requires physical access to attach a Conexant AccessRunner (cxacru) USB ADSL modem or a faulty device of that type during initialization; it is not network reachable and has no impact on confidentiality or integrity. The consequence is limited to a kernel warning and potential driver malfunction or system instability. The kernel and kernel-rt packages in Red Hat Enterprise Linux 7, 8, and 9 are affected, with the fix deferred on those streams because of the low severity and the hardware-specific, physical-access nature of the trigger; the residual risk is a kernel warning and possible instability on systems using this USB ADSL hardware. Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 are not affected because the vulnerable code is not present in their kernels. Red Hat rates this flaw as low impact (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting the local, physical-hardware requirement compared with a higher severity suggested by automated upstream analysis.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.