CVE-2025-22050None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: usbnet:fix NPE during rx_complete Missing usbnet_going_away Check in Critical Path. The usb_submit_urb function lacks a usbnet_going_away validation, whereas __usbnet_…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
In the Linux kernel, the following vulnerability has been resolved:
usbnet:fix NPE during rx_complete
Missing usbnet_going_away Check in Critical Path. The usb_submit_urb function lacks a usbnet_going_away validation, whereas __usbnet_queue_skb includes this check.
This inconsistency creates a race condition where: A URB request may succeed, but the corresponding SKB data fails to be queued.
Subsequent processes: (e.g., rx_complete → defer_bh → __skb_unlink(skb, list)) attempt to access skb->next, triggering a NULL pointer dereference (Kernel Panic).
Linux >= b80aacfea6e8d6ed6e430aa13922d6ccf044415a < 95789c2f94fd29dce8759f9766baa333f749287cLinux >= 869caa8de8cb94514df704ccbe0b024fda4b9398 < 0f10f83acfd619e13c64d6705908dfd792f19544Linux >= 1e44ee6cdd123d6cfe78b4a94e1572e23bbb58ce < acacd48a37b52fc95f621765762c04152b58d642Linux >= 04e906839a053f092ef53f4fb2d610983412b904 < d689645cd1594ea1d13cb0c404f8ad1011353e0eLinux >= 04e906839a053f092ef53f4fb2d610983412b904 < 0c30988588b28393e3e8873d5654f910e86391baLinux >= 04e906839a053f092ef53f4fb2d610983412b904 < fd9ee3f0d6a53844f65efde581c91bbb0ff749acLinux >= 04e906839a053f092ef53f4fb2d610983412b904 < 51de3600093429e3b712e5f091d767babc5dd6dfLinux ca124236cd14e61610f56df9a8f81376a1ffe660Linux 54671d731f4977fb3c0c26f2840655b5204e4437Linux >= 5.15.168 < 5.15.180Linux >= 6.1.113 < 6.1.134Linux >= 6.6.54 < 6.6.87Linux >= 6.10.13 < 6.11Linux >= 6.11.2 < 6.12Linux 6.12Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99284Nonenet: skbuff: propagate shared-frag marker in skb_zerocopy()
CVE-2026-99283Nonenetfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets
CVE-2026-99272Nonesmb: client: validate the data area in SMB2_read()
CVE-2026-99271NoneALSA: line6: Clear prev_fbuf on capture buffer release
CVE-2026-99273Noneksmbd: reserve space for the UTF-16 terminator in stream info
CVE-2026-99275Nonesmb: client: reject short SESSION_SETUP responses