CVE-2025-40140

The vulnerability is a race condition in the Linux kernel's rtl8150 USB Ethernet driver. The function rtl8150_set_multicast, which is the ndo_set_rx_mode callback, improperly calls netif_stop_queue and netif_wake_queue. This disrupts the TX queue synchronization managed by the core network stack [1][2].

An attacker able to trigger the set_multicast operation while a TX is in progress can cause the TX queue to be woken prematurely. This leads to a second URB submission before the first completes, resulting in a double submission that triggers a kernel WARNING in rtl8150_start_xmit [1].

The impact is a kernel warning that can cause a denial of service (system instability or panic). No privilege escalation is described [1][2].

The fix removes the disruptive netif_wake_queue call from rtl8150_set_multicast, as the net core function dev_set_rx_mode handles synchronization properly. The fix is included in stable kernel updates [2][3].