Medium 5.5Published Nov 12, 2025

CVE-2025-40164usbnet: Fix using smp_processor_id() in preemptible code warnings

Updated under an hour ago (Oct 26, 2026, 5:10 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: usbnet: Fix using smp_processor_id() in preemptible code warnings Syzbot reported the following warning: BUG: using smp_processor_id() in preemptible [00000000] code: dhcpcd/2879 caller is usbnet_skb_return+0x74/0x490 drivers/net/usb/usbnet.c:331 CPU: 1 UID: 0 PID: 2879 Comm: dhcpcd Not tainted 6.15.0-rc4-syzkaller-00098-g615dca38c2ea #0 PREEMPT(voluntary) Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 check_preemption_disabled+0xd0/0xe0 lib/smp_processor_id.c:49 usbnet_skb_return+0x74/0x490 drivers/net/usb/usbnet.c:331 usbnet_resume_rx+0x4b/0x170 drivers/net/usb/usbnet.c:708 usbnet_change_mtu+0x1be/0x220 drivers/net/usb/usbnet.c:417 __dev_set_mtu net/core/dev.c:9443 [inline] netif_set_mtu_ext+0x369/0x5c0 net/core/dev.c:9496 netif_set_mtu+0xb0/0x160 net/core/dev.c:9520 dev_set_mtu+0xae/0x170 net/core/dev_api.c:247 dev_ifsioc+0xa31/0x18d0 net/core/dev_ioctl.c:572 dev_ioctl+0x223/0x10e0 net/core/dev_ioctl.c:821 sock_do_ioctl+0x19d/0x280 net/socket.c:1204 sock_ioctl+0x42f/0x6a0 net/socket.c:1311 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl fs/ioctl.c:892 [inline] __x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f For historical and portability reasons, the netif_rx() is usually run in the softirq or interrupt context, this commit therefore add local_bh_disable/enable() protection in the usbnet_resume_rx().

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Jun 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 43daa96b166c3cf5ff30dfac0c5efa2620e4beab before 6635e52bc4165793aefd686962d912d73d323afe; from 43daa96b166c3cf5ff30dfac0c5efa2620e4beab before 65d04291adf7c59338f87aab9c6fe0bfa9993e64; from 43daa96b166c3cf5ff30dfac0c5efa2620e4beab before f45fffae5e2549bd0a4670cc52a15ad54c9f121e; 43daa96b166c3cf5ff30dfac0c5efa2620e4beab builds before 17fbad93879e87a334062882b45fa727ba1b3dd7; from 43daa96b166c3cf5ff30dfac0c5efa2620e4beab before d1944bab8e0c1511f0cbf364aa06547735bb0ddb; from 43daa96b166c3cf5ff30dfac0c5efa2620e4beab before 0134c7bff14bd50314a4f92b182850ddfc38e255; from 43daa96b166c3cf5ff30dfac0c5efa2620e4beab before 327cd4b68b4398b6c24f10eb2b2533ffbfc10185	CNA record
linux linux_kernel linux:linux_kernel	from 4.7.1 before 5.15.199; from 5.16 before 6.1.162; from 6.2 before 6.6.122; from 6.7 before 6.12.64; from 6.13 before 6.17.5; 4.7; 4.7; 6.18	NVD

References

References

https://git.kernel.org/stable/c/6635e52bc4165793aefd686962d912d73d323afe
https://git.kernel.org/stable/c/65d04291adf7c59338f87aab9c6fe0bfa9993e64	patch
https://git.kernel.org/stable/c/f45fffae5e2549bd0a4670cc52a15ad54c9f121e	patch
https://git.kernel.org/stable/c/17fbad93879e87a334062882b45fa727ba1b3dd7	patch
https://git.kernel.org/stable/c/d1944bab8e0c1511f0cbf364aa06547735bb0ddb	patch
https://git.kernel.org/stable/c/0134c7bff14bd50314a4f92b182850ddfc38e255	patch
https://git.kernel.org/stable/c/327cd4b68b4398b6c24f10eb2b2533ffbfc10185	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.