CVE-2026-63874

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the MCTP USB implementation. Improper sequencing between setting the stopped status and cancelling the rx retry work within the ndo stop() function can result in a USB Request Block (URB) remaining queued. This occurs when mctp usb rx queue() calls usb submit urb() concurrently with the stop process, potentially allowing the URB completion to reschedule the rx retry work after it was intended to be cancelled.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.