High 8.8Published Nov 12, 2025

CVE-2025-40140net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast

Updated under an hour ago (Oct 26, 2026, 3:50 PM ET)

This data is behind schedule: last updated Oct 26, 2026, 3:50 PM ET. We are working on it.Behind: CVE records (cvelistV5).

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb. This is the sequence of events that leads to the warning: rtl8150_start_xmit() { netif_stop_queue(); usb_submit_urb(dev->tx_urb); } rtl8150_set_multicast() { netif_stop_queue(); netif_wake_queue(); <-- wakes up TX queue before URB is done } rtl8150_start_xmit() { netif_stop_queue(); usb_submit_urb(dev->tx_urb); <-- double submission } rtl8150_set_multicast being the ndo_set_rx_mode callback should not be calling netif_stop_queue and notif_start_queue as these handle TX queue synchronization. The net core function dev_set_rx_mode handles the synchronization for rtl8150_set_multicast making it safe to remove these locks.

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Deferred
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before cce3c0e21cdd15bcba5c35d3af1700186de8f187; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 builds before 1a08a37ac03d07a1608a1592791041cac979fbc3; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 54f8ef1a970a8376e5846ed90854decf7c00555d; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 114e05344763a102a8844efd96ec06ba99293ccd; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 6394bade9daab8e318c165fe43bba012bf13cd8e; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 6053e47bbf212b93c051beb4261d7d5a409d0ce3; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 9d72df7f5eac946f853bf49c428c4e87a17d91da; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 958baf5eaee394e5fd976979b0791a875f14a179	CNA record

References

References

https://git.kernel.org/stable/c/cce3c0e21cdd15bcba5c35d3af1700186de8f187
https://git.kernel.org/stable/c/1a08a37ac03d07a1608a1592791041cac979fbc3
https://git.kernel.org/stable/c/54f8ef1a970a8376e5846ed90854decf7c00555d
https://git.kernel.org/stable/c/114e05344763a102a8844efd96ec06ba99293ccd
https://git.kernel.org/stable/c/6394bade9daab8e318c165fe43bba012bf13cd8e
https://git.kernel.org/stable/c/6053e47bbf212b93c051beb4261d7d5a409d0ce3
https://git.kernel.org/stable/c/9d72df7f5eac946f853bf49c428c4e87a17d91da
https://git.kernel.org/stable/c/958baf5eaee394e5fd976979b0791a875f14a179

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.