---
id: CVE-2025-22050
title: 'usbnet:fix NPE during rx_complete'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  usbnet:fix NPE during rx_complete

  Missing usbnet_going_away Check in Critical Path.
  The usb_submit_urb function lacks a usbnet_going_away
  validation, whereas __usbnet_…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= b80aacfea6e8d6ed6e430aa13922d6ccf044415a <
    95789c2f94fd29dce8759f9766baa333f749287c
  - >-
    Linux >= 869caa8de8cb94514df704ccbe0b024fda4b9398 <
    0f10f83acfd619e13c64d6705908dfd792f19544
  - >-
    Linux >= 1e44ee6cdd123d6cfe78b4a94e1572e23bbb58ce <
    acacd48a37b52fc95f621765762c04152b58d642
  - >-
    Linux >= 04e906839a053f092ef53f4fb2d610983412b904 <
    d689645cd1594ea1d13cb0c404f8ad1011353e0e
  - >-
    Linux >= 04e906839a053f092ef53f4fb2d610983412b904 <
    0c30988588b28393e3e8873d5654f910e86391ba
  - >-
    Linux >= 04e906839a053f092ef53f4fb2d610983412b904 <
    fd9ee3f0d6a53844f65efde581c91bbb0ff749ac
  - >-
    Linux >= 04e906839a053f092ef53f4fb2d610983412b904 <
    51de3600093429e3b712e5f091d767babc5dd6df
  - Linux ca124236cd14e61610f56df9a8f81376a1ffe660
  - Linux 54671d731f4977fb3c0c26f2840655b5204e4437
  - Linux >= 5.15.168 < 5.15.180
  - Linux >= 6.1.113 < 6.1.134
  - Linux >= 6.6.54 < 6.6.87
  - Linux >= 6.10.13 < 6.11
  - Linux >= 6.11.2 < 6.12
  - Linux 6.12
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:38:15.922602Z'
published: '2025-04-16'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:41:49.709Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-22050'
references:
  - url: 'https://git.kernel.org/stable/c/95789c2f94fd29dce8759f9766baa333f749287c'
  - url: 'https://git.kernel.org/stable/c/0f10f83acfd619e13c64d6705908dfd792f19544'
  - url: 'https://git.kernel.org/stable/c/acacd48a37b52fc95f621765762c04152b58d642'
  - url: 'https://git.kernel.org/stable/c/d689645cd1594ea1d13cb0c404f8ad1011353e0e'
  - url: 'https://git.kernel.org/stable/c/0c30988588b28393e3e8873d5654f910e86391ba'
  - url: 'https://git.kernel.org/stable/c/fd9ee3f0d6a53844f65efde581c91bbb0ff749ac'
  - url: 'https://git.kernel.org/stable/c/51de3600093429e3b712e5f091d767babc5dd6df'
tags:
  - cve.org
epss: 0.00196
epssPercentile: 0.0938
ingestedAt: '2026-11-05T22:38:31.859Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

usbnet:fix NPE during rx_complete

Missing usbnet_going_away Check in Critical Path.
The usb_submit_urb function lacks a usbnet_going_away
validation, whereas __usbnet_queue_skb includes this check.

This inconsistency creates a race condition where:
A URB request may succeed, but the corresponding SKB data
fails to be queued.

Subsequent processes:
(e.g., rx_complete → defer_bh → __skb_unlink(skb, list))
attempt to access skb->next, triggering a NULL pointer
dereference (Kernel Panic).

## Affected

- `Linux >= b80aacfea6e8d6ed6e430aa13922d6ccf044415a < 95789c2f94fd29dce8759f9766baa333f749287c`
- `Linux >= 869caa8de8cb94514df704ccbe0b024fda4b9398 < 0f10f83acfd619e13c64d6705908dfd792f19544`
- `Linux >= 1e44ee6cdd123d6cfe78b4a94e1572e23bbb58ce < acacd48a37b52fc95f621765762c04152b58d642`
- `Linux >= 04e906839a053f092ef53f4fb2d610983412b904 < d689645cd1594ea1d13cb0c404f8ad1011353e0e`
- `Linux >= 04e906839a053f092ef53f4fb2d610983412b904 < 0c30988588b28393e3e8873d5654f910e86391ba`
- `Linux >= 04e906839a053f092ef53f4fb2d610983412b904 < fd9ee3f0d6a53844f65efde581c91bbb0ff749ac`
- `Linux >= 04e906839a053f092ef53f4fb2d610983412b904 < 51de3600093429e3b712e5f091d767babc5dd6df`
- `Linux ca124236cd14e61610f56df9a8f81376a1ffe660`
- `Linux 54671d731f4977fb3c0c26f2840655b5204e4437`
- `Linux >= 5.15.168 < 5.15.180`
- `Linux >= 6.1.113 < 6.1.134`
- `Linux >= 6.6.54 < 6.6.87`
- `Linux >= 6.10.13 < 6.11`
- `Linux >= 6.11.2 < 6.12`
- `Linux 6.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.