CVE-2026-23061

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23061
In the Linux kernel, the following vulnerability has been resolved: can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak"). In kvaser_usb_set_{,data_}bittiming() -> kvaser_usb_setup_rx_urbs(), the URBs for USB-in transfers are allocated, added to the dev->rx_submitted anchor and submitted. In the complete callback kvaser_usb_read_bulk_callback(), the URBs are processed and resubmitted. In kvaser_usb_remove_interfaces() the URBs are freed by calling usb_kill_anchored_urbs(&dev->rx_submitted). However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in usb_kill_anchored_urbs(). Fix the memory leak by anchoring the URB in the kvaser_usb_read_bulk_callback() to the dev->rx_submitted anchor.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/248e8e1a125fa875158df521b30f2cc7e27eeeaa Patch
https://git.kernel.org/stable/c/3b1a593eab941c3f32417896cc7df564191f2482 Patch
https://git.kernel.org/stable/c/40a3334ffda479c63e416e61ff086485e24401f7 Patch
https://git.kernel.org/stable/c/7c308f7530bffafa994e0aa8dc651a312f4b9ff4 Patch
https://git.kernel.org/stable/c/94a7fc42e21c7d9d1c49778cd1db52de5df52a01 Patch
https://git.kernel.org/stable/c/c1b39fa24c140bc616f51fef4175c1743e2bb132 Patch
https://git.kernel.org/stable/c/d9d824582f2ec76459ffab449e9b05c7bc49645c Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*
History

13 Mar 2026, 21:28

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: can: kvaser_usb: kvaser_usb_read_bulk_callback(): corregir fuga de memoria de URB Corregir fuga de memoria similar a la del commit 7352e1d5932a ('can: gs_usb: gs_usb_receive_bulk_callback(): corregir fuga de memoria de URB'). En kvaser_usb_set_{,data_}bittiming() -> kvaser_usb_setup_rx_urbs(), los URB para transferencias USB de entrada se asignan, se añaden al ancla dev->rx_submitted y se envían. En la función de devolución de llamada completa kvaser_usb_read_bulk_callback(), los URB se procesan y se reenvían. En kvaser_usb_remove_interfaces(), los URB se liberan llamando a usb_kill_anchored_urbs(&dev->rx_submitted). Sin embargo, esto no tiene en cuenta que el framework USB desancla el URB antes de que se llame a la función completa. Esto significa que una vez que un URB de entrada ha sido completado, ya no está anclado y finalmente no se libera en usb_kill_anchored_urbs(). Corregir la fuga de memoria anclando el URB en kvaser_usb_read_bulk_callback() al ancla dev->rx_submitted.
CPE cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
CWE CWE-401
First Time Linux
Linux linux Kernel
References () https://git.kernel.org/stable/c/248e8e1a125fa875158df521b30f2cc7e27eeeaa - () https://git.kernel.org/stable/c/248e8e1a125fa875158df521b30f2cc7e27eeeaa - Patch
References () https://git.kernel.org/stable/c/3b1a593eab941c3f32417896cc7df564191f2482 - () https://git.kernel.org/stable/c/3b1a593eab941c3f32417896cc7df564191f2482 - Patch
References () https://git.kernel.org/stable/c/40a3334ffda479c63e416e61ff086485e24401f7 - () https://git.kernel.org/stable/c/40a3334ffda479c63e416e61ff086485e24401f7 - Patch
References () https://git.kernel.org/stable/c/7c308f7530bffafa994e0aa8dc651a312f4b9ff4 - () https://git.kernel.org/stable/c/7c308f7530bffafa994e0aa8dc651a312f4b9ff4 - Patch
References () https://git.kernel.org/stable/c/94a7fc42e21c7d9d1c49778cd1db52de5df52a01 - () https://git.kernel.org/stable/c/94a7fc42e21c7d9d1c49778cd1db52de5df52a01 - Patch
References () https://git.kernel.org/stable/c/c1b39fa24c140bc616f51fef4175c1743e2bb132 - () https://git.kernel.org/stable/c/c1b39fa24c140bc616f51fef4175c1743e2bb132 - Patch
References () https://git.kernel.org/stable/c/d9d824582f2ec76459ffab449e9b05c7bc49645c - () https://git.kernel.org/stable/c/d9d824582f2ec76459ffab449e9b05c7bc49645c - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

06 Feb 2026, 17:16

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/40a3334ffda479c63e416e61ff086485e24401f7 -
  • () https://git.kernel.org/stable/c/c1b39fa24c140bc616f51fef4175c1743e2bb132 -
  • () https://git.kernel.org/stable/c/d9d824582f2ec76459ffab449e9b05c7bc49645c -

04 Feb 2026, 17:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-04 17:16

Updated : 2026-03-13 21:28

NVD link : CVE-2026-23061

Mitre link : CVE-2026-23061

CVE.ORG link : CVE-2026-23061

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime