Linux Kernel Vulnerability in RTL8150 USB Driver

CVE-2025-40140

What is CVE-2025-40140?

A synchronization issue was identified in the RTL8150 USB driver within the Linux kernel. The flaw occurs due to improper handling of TX queue synchronization in the functions rtl8150_start_xmit and rtl8150_set_multicast. Specifically, calling netif_stop_queue and netif_wake_queue in rtl8150_set_multicast can lead to double submissions of the same transmit request, potentially destabilizing network operations. This vulnerability has been addressed by modifying the synchronization process to allow the net core function dev_set_rx_mode to efficiently manage queue states without additional locking mechanisms.

References