CVE-2026-53107

What it actually does

This is a Linux kernel denial-of-service flaw in the Libertas Wi-Fi USB driver TX path. The vulnerable code can call usb_kill_urb() or usb_kill_anchored_urbs() from interrupt context, where sleeping is not permitted. If the timing condition is hit while transmit URBs are still pending, the kernel can emit invalid-context warnings and may hang, crash, or otherwise destabilize the affected system. Impact is limited to systems that load and use the affected Libertas Wi-Fi driver and compatible USB Wi-Fi hardware.

Why it matters to the business

Organizations using affected Linux kernels with Libertas USB Wi-Fi devices may experience unexpected endpoint, appliance, or embedded-device outages. This is primarily an availability risk rather than a data theft risk. The currently reported EPSS score is very low, it is not listed in CISA KEV, and there is no known ransomware association, so urgency should be driven by whether the driver and hardware are present in production, remote sites, kiosks, IoT, or operational environments where device reboots cause service disruption.

How an attack unfolds

An attacker first needs a system running an affected Linux kernel with the Libertas USB Wi-Fi driver active and associated hardware in use. The attacker then causes transmit activity that interacts with the driver’s USB request handling, attempting to trigger the race/timing condition where the TX path tries to kill in-flight URBs from interrupt context. When the vulnerable path is reached, the kernel performs an operation that can sleep while in an invalid context, which can lead to kernel warnings, driver malfunction, system instability, or a denial-of-service condition. There is no indication of public weaponized exploitation, and practical exploitation appears dependent on hardware, driver state, and timing.

How to fix it

Apply the Linux kernel update from the relevant distribution, device vendor, or kernel maintenance branch that includes the Libertas driver fix for preventing URB-kill operations from interrupt context. If no fixed package is immediately available, mitigate by disabling or unloading unused Libertas-related modules, blacklisting the affected driver where the hardware is not required, replacing affected USB Wi-Fi adapters with supported alternatives, or using a wired or different wireless interface. For embedded products, obtain a vendor firmware or BSP update that incorporates the corrected kernel driver behavior.

How to confirm the fix worked

Confirm that the running kernel includes the vendor fix for the Libertas USB Wi-Fi driver. Validate through distribution advisories, kernel package changelogs, source patches, or vendor firmware release notes referencing the Libertas change to avoid killing URBs in interrupt context. Check whether the system is exposed by looking for loaded Libertas modules, attached compatible USB Wi-Fi hardware, and active wireless interfaces using that driver. After remediation, monitor kernel logs during normal Wi-Fi transmit activity and confirm there are no recurring invalid-context, URB, or Libertas-related warnings, oopses, panics, or device resets.

Typical attack path

1. Identify a Linux system using the Libertas Wi-Fi USB driver and compatible hardware.
2. Create or induce Wi-Fi transmit activity through normal networking behavior or local traffic generation.
3. Trigger timing where a prior USB transmit request is still pending when the driver attempts TX serialization.
4. Cause the vulnerable driver path to call URB-kill logic from interrupt context.
5. Result in kernel warning, driver disruption, hang, crash, or reboot, producing denial of service.

How to detect it

To determine whether this was already triggered, review kernel logs and persistent journal data for crashes or warnings involving the Libertas Wi-Fi driver, USB URB handling, interrupt-context sleep violations, HCD giveback paths, kernel oopses, panics, device resets, or unexplained reboots. Useful sources include dmesg output, systemd journal kernel facility logs, /var/log/kern.log, /var/log/messages, crash dumps, pstore/ramoops records, kdump/vmcore data, and device-management telemetry showing unexpected restarts. Focus on timestamps where Wi-Fi transmit activity, USB disconnect/reconnect events, or network instability occurred. There are no known attacker-specific network indicators; detection is primarily based on kernel crash artifacts and driver/runtime symptoms.

• BUG: sleeping function called from invalid context
• usb_kill_urb
• usb_kill_anchored_urbs
• libertas
• libertas_usb
• usb_tx_block
• tx_submitted
• URB
• HCD giveback
• kernel panic
• kernel oops
• /var/log/kern.log
• /var/log/messages
• /sys/module/libertas_usb
• /sys/module/libertas

What your security team should do

• Inventory Linux systems, appliances, and embedded devices that use USB Wi-Fi, especially those loading Libertas-related kernel modules.
• Prioritize patching systems where Libertas Wi-Fi is active in production or where device outages would affect operations.
• Apply vendor kernel, firmware, or BSP updates that include the corrected Libertas TX-path behavior.
• Disable or blacklist the affected driver on systems that do not require Libertas Wi-Fi support.
• Monitor kernel logs for Libertas, USB URB, invalid interrupt-context, oops, panic, or unexpected reboot events.
• Treat this as a targeted availability risk: current EPSS is low, it is not in KEV, and no mature public exploit is reported, but exposed operational devices should still be remediated.