CVE-2026-23075

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23075
In the Linux kernel, the following vulnerability has been resolved: can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak"). In esd_usb_open(), the URBs for USB-in transfers are allocated, added to the dev->rx_submitted anchor and submitted. In the complete callback esd_usb_read_bulk_callback(), the URBs are processed and resubmitted. In esd_usb_close() the URBs are freed by calling usb_kill_anchored_urbs(&dev->rx_submitted). However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in esd_usb_close(). Fix the memory leak by anchoring the URB in the esd_usb_read_bulk_callback() to the dev->rx_submitted anchor.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/5a4391bdc6c8357242f62f22069c865b792406b3 Patch
https://git.kernel.org/stable/c/92d26ce07ac3b7a850dc68c8d73d487b39c39b33 Patch
https://git.kernel.org/stable/c/93b34d4ba7266030801a509c088ac77c0d7a12e9 Patch
https://git.kernel.org/stable/c/9d1807b442fc3286b204f8e59981b10e743533ce Patch
https://git.kernel.org/stable/c/a9503ae43256e80db5cba9d449b238607164c51d Patch
https://git.kernel.org/stable/c/adec5e1f9c99fe079ec4c92cca3f1109a3e257c3 Patch
https://git.kernel.org/stable/c/dc934d96673992af8568664c1b58e13eb164010d Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*
History

18 Mar 2026, 17:16

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/5a4391bdc6c8357242f62f22069c865b792406b3 - () https://git.kernel.org/stable/c/5a4391bdc6c8357242f62f22069c865b792406b3 - Patch
References () https://git.kernel.org/stable/c/92d26ce07ac3b7a850dc68c8d73d487b39c39b33 - () https://git.kernel.org/stable/c/92d26ce07ac3b7a850dc68c8d73d487b39c39b33 - Patch
References () https://git.kernel.org/stable/c/93b34d4ba7266030801a509c088ac77c0d7a12e9 - () https://git.kernel.org/stable/c/93b34d4ba7266030801a509c088ac77c0d7a12e9 - Patch
References () https://git.kernel.org/stable/c/9d1807b442fc3286b204f8e59981b10e743533ce - () https://git.kernel.org/stable/c/9d1807b442fc3286b204f8e59981b10e743533ce - Patch
References () https://git.kernel.org/stable/c/a9503ae43256e80db5cba9d449b238607164c51d - () https://git.kernel.org/stable/c/a9503ae43256e80db5cba9d449b238607164c51d - Patch
References () https://git.kernel.org/stable/c/adec5e1f9c99fe079ec4c92cca3f1109a3e257c3 - () https://git.kernel.org/stable/c/adec5e1f9c99fe079ec4c92cca3f1109a3e257c3 - Patch
References () https://git.kernel.org/stable/c/dc934d96673992af8568664c1b58e13eb164010d - () https://git.kernel.org/stable/c/dc934d96673992af8568664c1b58e13eb164010d - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: can: esd_usb: esd_usb_read_bulk_callback(): corregir fuga de memoria de URB Corregir fuga de memoria similar a la del commit 7352e1d5932a ('can: gs_usb: gs_usb_receive_bulk_callback(): corregir fuga de memoria de URB'). En esd_usb_open(), los URB para transferencias USB de entrada son asignados, añadidos al ancla dev->rx_submitted y enviados. En la función de devolución de llamada completa esd_usb_read_bulk_callback(), los URB son procesados y reenviados. En esd_usb_close(), los URB son liberados llamando a usb_kill_anchored_urbs(&dev->rx_submitted). Sin embargo, esto no tiene en cuenta que el framework USB desancla el URB antes de que se llame a la función completa. Esto significa que una vez que un URB de entrada ha sido completado, ya no está anclado y finalmente no es liberado en esd_usb_close(). Corregir la fuga de memoria anclando el URB en esd_usb_read_bulk_callback() al ancla dev->rx_submitted.
CWE CWE-401
First Time Linux
Linux linux Kernel

06 Feb 2026, 17:16

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/92d26ce07ac3b7a850dc68c8d73d487b39c39b33 -
  • () https://git.kernel.org/stable/c/93b34d4ba7266030801a509c088ac77c0d7a12e9 -
  • () https://git.kernel.org/stable/c/dc934d96673992af8568664c1b58e13eb164010d -

04 Feb 2026, 17:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-04 17:16

Updated : 2026-03-18 17:16

NVD link : CVE-2026-23075

Mitre link : CVE-2026-23075

CVE.ORG link : CVE-2026-23075

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime