CVE-2026-23037: can: etas_es58x: allow partial RX URB allocation to succeed
In the Linux kernel, the following vulnerability has been resolved:
can: etases58x: allow partial RX URB allocation to succeed
When es58xallocrxurbs() fails to allocate the requested number of URBs but succeeds in allocating some, it returns an error code. This causes es58xopen() to return early, skipping the cleanup label 'freeurbs', which leads to the anchored URBs being leaked.
As pointed out by maintainer Vincent Mailhol, the driver is designed to handle partial URB allocation gracefully. Therefore, partial allocation should not be treated as a fatal error.
Modify es58xallocrxurbs() to return 0 if at least one URB has been allocated, restoring the intended behavior and preventing the leak in es58xopen().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23037?
CVE-2026-23037 has a severity rating of medium due to its potential impact on the system's stability.
How do I fix CVE-2026-23037?
To fix CVE-2026-23037, update the Linux kernel to the latest version where the vulnerability is patched.
What are the effects of CVE-2026-23037 on system performance?
CVE-2026-23037 could lead to degraded performance and unexpected behavior during USB transfer operations.
Is CVE-2026-23037 present in all Linux kernel versions?
CVE-2026-23037 is specifically relevant to affected versions of the Linux kernel that include the etas_es58x driver.
Can CVE-2026-23037 be exploited remotely?
CVE-2026-23037 does not appear to be exploitable remotely, as it requires access to the system handling USB communications.