CVE-2025-40164

usbnet: Fix using smp_processor_id() in preemptible code warnings

MEDIUM
5.5
CVSS Score
Published: November 12, 2025 at 10:26 AM UTC
Updated: October 19, 2026 at 09:10 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: usbnet: Fix using smp_processor_id() in preemptible code warnings Syzbot reported the following warning: BUG: using smp_processor_id() in preemptible [00000000] code: dhcpcd/2879 caller is usbnet_skb_return+0x74/0x490 drivers/net/usb/usbnet.c:331 CPU: 1 UID: 0 PID: 2879 Comm: dhcpcd Not tainted 6.15.0-rc4-syzkaller-00098-g615dca38c2ea #0 PREEMPT(voluntary) Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 check_preemption_disabled+0xd0/0xe0 lib/smp_processor_id.c:49 usbnet_skb_return+0x74/0x490 drivers/net/usb/usbnet.c:331 usbnet_resume_rx+0x4b/0x170 drivers/net/usb/usbnet.c:708 usbnet_change_mtu+0x1be/0x220 drivers/net/usb/usbnet.c:417 __dev_set_mtu net/core/dev.c:9443 [inline] netif_set_mtu_ext+0x369/0x5c0 net/core/dev.c:9496 netif_set_mtu+0xb0/0x160 net/core/dev.c:9520 dev_set_mtu+0xae/0x170 net/core/dev_api.c:247 dev_ifsioc+0xa31/0x18d0 net/core/dev_ioctl.c:572 dev_ioctl+0x223/0x10e0 net/core/dev_ioctl.c:821 sock_do_ioctl+0x19d/0x280 net/socket.c:1204 sock_ioctl+0x42f/0x6a0 net/socket.c:1311 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl fs/ioctl.c:892 [inline] __x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f For historical and portability reasons, the netif_rx() is usually run in the softirq or interrupt context, this commit therefore add local_bh_disable/enable() protection in the usbnet_resume_rx().

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

4.7.1 ≤ v < 5.15.1995.16 ≤ v < 6.1.1626.13 ≤ v < 6.17.56.2 ≤ v < 6.6.1226.7 ≤ v < 6.12.644.74.7 rc743daa96b166c3cf5ff30dfac0c5efa2620e4beab6.186.18 rc1
Vendor states this is fixed in 0134c7bff14bd50314a4f92b182850ddfc38e255 (fixed)
Vendor states this is fixed in 17fbad93879e87a334062882b45fa727ba1b3dd7 (fixed)
Vendor states this is fixed in 327cd4b68b4398b6c24f10eb2b2533ffbfc10185 (fixed)
Vendor states this is fixed in 65d04291adf7c59338f87aab9c6fe0bfa9993e64 (fixed)
Vendor states this is fixed in 6635e52bc4165793aefd686962d912d73d323afe (fixed)
Vendor states this is fixed in d1944bab8e0c1511f0cbf364aa06547735bb0ddb (fixed)
Vendor states this is fixed in f45fffae5e2549bd0a4670cc52a15ad54c9f121e (fixed)
Vendor states this is fixed in 4.7 (unaffected)
Vendor states this is fixed in 5.10.259 (unaffected)
Vendor states this is fixed in 5.15.199 (unaffected)
Vendor states this is fixed in 6.1.162 (unaffected)
Vendor states this is fixed in 6.12.64 (unaffected)
Vendor states this is fixed in 6.17.5 (unaffected)
Vendor states this is fixed in 6.18 (unaffected)
Vendor states this is fixed in 6.6.122 (unaffected)

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
NVD-CWE-noinfo

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card