CVE-2026-23108

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23108
In the Linux kernel, the following vulnerability has been resolved: can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak"). In usb_8dev_open() -> usb_8dev_start(), the URBs for USB-in transfers are allocated, added to the priv->rx_submitted anchor and submitted. In the complete callback usb_8dev_read_bulk_callback(), the URBs are processed and resubmitted. In usb_8dev_close() -> unlink_all_urbs() the URBs are freed by calling usb_kill_anchored_urbs(&priv->rx_submitted). However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in usb_kill_anchored_urbs(). Fix the memory leak by anchoring the URB in the usb_8dev_read_bulk_callback() to the priv->rx_submitted anchor.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/07e9373739c6388af9d99797cdb2e79dbbcbe92b Patch
https://git.kernel.org/stable/c/59ff56992bba28051ad67cd8cc7b0edfe7280796 Patch
https://git.kernel.org/stable/c/60719661b4cbd7ffbed1a0e0fa3bbc82d8bd2be9 Patch
https://git.kernel.org/stable/c/ea4a98e924164586066b39f29bfcc7cc9da108cd Patch
https://git.kernel.org/stable/c/ef6e608e5ee71eca0cd3475c737e684cef24f240 Patch
https://git.kernel.org/stable/c/f7a980b3b8f80fe367f679da376cf76e800f9480 Patch
https://git.kernel.org/stable/c/feb8243eaea7efd5279b19667d7189fd8654c87a Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*
History

18 Mar 2026, 17:12

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: can: usb_8dev: usb_8dev_read_bulk_callback(): corregir fuga de memoria de URB Corrige una fuga de memoria similar a la del commit 7352e1d5932a ('can: gs_usb: gs_usb_receive_bulk_callback(): corregir fuga de memoria de URB'). En usb_8dev_open() -> usb_8dev_start(), los URB para transferencias USB de entrada se asignan, se añaden al ancla priv->rx_submitted y se envían. En la función de devolución de llamada completa usb_8dev_read_bulk_callback(), los URB se procesan y se reenvían. En usb_8dev_close() -> unlink_all_urbs(), los URB se liberan llamando a usb_kill_anchored_urbs(&priv->rx_submitted). Sin embargo, esto no tiene en cuenta que el framework USB desancla el URB antes de que se llame a la función completa. Esto significa que una vez que un URB de entrada ha sido completado, ya no está anclado y finalmente no se libera en usb_kill_anchored_urbs(). Corrige la fuga de memoria anclando el URB en usb_8dev_read_bulk_callback() al ancla priv->rx_submitted.
CWE CWE-401
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/07e9373739c6388af9d99797cdb2e79dbbcbe92b - () https://git.kernel.org/stable/c/07e9373739c6388af9d99797cdb2e79dbbcbe92b - Patch
References () https://git.kernel.org/stable/c/59ff56992bba28051ad67cd8cc7b0edfe7280796 - () https://git.kernel.org/stable/c/59ff56992bba28051ad67cd8cc7b0edfe7280796 - Patch
References () https://git.kernel.org/stable/c/60719661b4cbd7ffbed1a0e0fa3bbc82d8bd2be9 - () https://git.kernel.org/stable/c/60719661b4cbd7ffbed1a0e0fa3bbc82d8bd2be9 - Patch
References () https://git.kernel.org/stable/c/ea4a98e924164586066b39f29bfcc7cc9da108cd - () https://git.kernel.org/stable/c/ea4a98e924164586066b39f29bfcc7cc9da108cd - Patch
References () https://git.kernel.org/stable/c/ef6e608e5ee71eca0cd3475c737e684cef24f240 - () https://git.kernel.org/stable/c/ef6e608e5ee71eca0cd3475c737e684cef24f240 - Patch
References () https://git.kernel.org/stable/c/f7a980b3b8f80fe367f679da376cf76e800f9480 - () https://git.kernel.org/stable/c/f7a980b3b8f80fe367f679da376cf76e800f9480 - Patch
References () https://git.kernel.org/stable/c/feb8243eaea7efd5279b19667d7189fd8654c87a - () https://git.kernel.org/stable/c/feb8243eaea7efd5279b19667d7189fd8654c87a - Patch

06 Feb 2026, 17:16

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/60719661b4cbd7ffbed1a0e0fa3bbc82d8bd2be9 -
  • () https://git.kernel.org/stable/c/ef6e608e5ee71eca0cd3475c737e684cef24f240 -
  • () https://git.kernel.org/stable/c/feb8243eaea7efd5279b19667d7189fd8654c87a -

04 Feb 2026, 17:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-04 17:16

Updated : 2026-03-18 17:12

NVD link : CVE-2026-23108

Mitre link : CVE-2026-23108

CVE.ORG link : CVE-2026-23108

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime