CVE-2026-23031: can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak
In the Linux kernel, the following vulnerability has been resolved:
can: gsusb: gsusbreceivebulkcallback(): fix URB memory leak
In gscanopen(), the URBs for USB-in transfers are allocated, added to the parent->rxsubmitted anchor and submitted. In the complete callback gsusbreceivebulkcallback(), the URB is processed and resubmitted. In gscanclose() the URBs are freed by calling usbkillanchoredurbs(parent->rxsubmitted).
However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in gscanclose().
Fix the memory leak by anchoring the URB in the gsusbreceivebulkcallback() to the parent->rxsubmitted anchor.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In gs_usb_receive_bulk_callback(), re-anchor the completed URB to the parent->rx_submitted anchor before resubmitting it, because the USB framework unanchors the URB before invoking the complete callback.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23031?
CVE-2026-23031 has been classified with a moderate severity rating due to the potential for memory leaks in the Linux kernel.
How do I fix CVE-2026-23031?
To address the issue related to CVE-2026-23031, it is recommended to apply the latest patches provided by the Linux kernel maintainers.
What are the consequences of not fixing CVE-2026-23031?
Failing to fix CVE-2026-23031 may result in increased memory usage and potential performance degradation in affected systems.
Which systems are affected by CVE-2026-23031?
CVE-2026-23031 affects various versions of the Linux kernel that implement the gs_usb driver for CAN devices.
Is CVE-2026-23031 exploited in the wild?
As of now, there is no public knowledge of active exploits for CVE-2026-23031.