CVE-2026-43255

Vulnerability

The function usb_tx_block() in the libertas WiFi driver for USB devices submits cardp->tx_urb without ensuring that any previous transmission on that URB has completed. If a second call occurs while the URB is still active—for example, during rapid firmware loading—usb_submit_urb() detects the active state and triggers a kernel WARNING: "URB submitted while active" [1]. The root cause is a missing serialization mechanism.

Exploitation

An attacker with local access can trigger this condition by causing concurrent calls to usb_tx_block(), such as through rapid firmware loading operations. No special privileges beyond local user access are required, and the attack does not depend on network reachability. The vulnerability is exposed through the libertas driver's interaction with USB devices.

Impact

The kernel WARNING can lead to system instability or a denial-of-service condition, as the warning itself may disrupt normal operation. The CVSS v3 score of 5.5 (Medium) reflects a primarily availability impact, with no direct confidentiality or integrity compromise.

Mitigation

The fix enforces serialization by calling usb_kill_urb() before submitting a new request, ensuring the URB is idle and safe to reuse. This patch has been backported to multiple stable kernel branches [1][2][3][4]. Users should update to the latest stable kernel version to eliminate the warning.