FlawAtlas
Search the atlas
CVE-2025-40140 Not scored

net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast

In the Linux kernel, the following vulnerability has been resolved: net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb. This is the sequence of events that leads to the warning: rtl8150_start_xmit() { netif_stop_queue(); usb_submit_urb(dev->tx_urb); } rtl8150_set_multicast() { netif_stop_queue(); netif_wake_queue(); <-- wakes up TX queue before URB is done } rtl8150_start_xmit() { netif_stop_queue(); usb_submit_urb(dev->tx_urb); <-- double submission } rtl8150_set_multicast being the ndo_set_rx_mode callback should not be calling netif_stop_queue and notif_start_queue as these handle TX queue synchronization. The net core function dev_set_rx_mode handles the synchronization for rtl8150_set_multicast making it safe to remove these locks.

Exploit probability 0.2%
Published November 12, 2025
Required by Not available
Last source change July 15, 2026

02 / AFFECTED SOFTWARE

Affected packages

Linux Kernel
Unknown Unknown

1942 explicit affected versions

03 / CONNECTIONS

Connected vulnerabilities

related OPENSUSE-SU-2025:20172-1
related SUSE-SU-2025:4393-1
related SUSE-SU-2025:4422-1
related SUSE-SU-2025:4505-1
related SUSE-SU-2025:4516-1
related SUSE-SU-2025:4517-1
related SUSE-SU-2025:4521-1
related SUSE-SU-2026:20012-1
related SUSE-SU-2026:20015-1
related SUSE-SU-2026:20021-1
related SUSE-SU-2026:20039-1
related SUSE-SU-2026:20059-1
related SUSE-SU-2026:20473-1
related SUSE-SU-2026:20496-1

04 / EVIDENCE

Source records

Open Source Vulnerabilities CVE-2025-40140

In the Linux kernel, the following vulnerability has been resolved: net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb. This is the sequence of events that leads to the warning: rtl8150_start_xmit() { netif_stop_queue(); usb_submit_urb(dev->tx_urb); } rtl8150_set_multicast() { netif_stop_queue(); netif_wake_queue(); <-- wakes up TX queue before URB is done } rtl8150_start_xmit() { netif_stop_queue(); usb_submit_urb(dev->tx_urb); <-- double submission } rtl8150_set_multicast being the ndo_set_rx_mode callback should not be calling netif_stop_queue and notif_start_queue as these handle TX queue synchronization. The net core function dev_set_rx_mode handles the synchronization for rtl8150_set_multicast making it safe to remove these locks.

View original source

05 / REFERENCES

Further evidence