CVE-2026-74680

A low impact flaw was found in the Linux kernel cxacru USB ADSL ATM driver. When the cxacru_cm() function encounters an error while submitting or waiting for the send URB, it returns without killing the already submitted receive URB (rcv_urb). If the error is ignored during device initialization and cxacru_cm() is invoked again (for example via cxacru_poll_status()), the still-active receive URB is resubmitted, which triggers a WARNING in usb_submit_urb(). Triggering this flaw requires physical access to attach a Conexant AccessRunner (cxacru) USB ADSL modem or a faulty device of that type during initialization; it is not network reachable and has no impact on confidentiality or integrity. The consequence is limited to a kernel warning and potential driver malfunction or system instability. The kernel and kernel-rt packages in Red Hat Enterprise Linux 7, 8, and 9 are affected, with the fix deferred on those streams because of the low severity and the hardware-specific, physical-access nature of the trigger; the residual risk is a kernel warning and possible instability on systems using this USB ADSL hardware. Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 are not affected because the vulnerable code is not present in their kernels. Red Hat rates this flaw as low impact (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting the local, physical-hardware requirement compared with a higher severity suggested by automated upstream analysis.