CVE-2026-23058: can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak
In the Linux kernel, the following vulnerability has been resolved:
can: emsusb: emsusbreadbulkcallback(): fix URB memory leak
Fix similar memory leak as in commit 7352e1d5932a ("can: gsusb: gsusbreceivebulkcallback(): fix URB memory leak").
In emsusbopen(), the URBs for USB-in transfers are allocated, added to the dev->rxsubmitted anchor and submitted. In the complete callback emsusbreadbulkcallback(), the URBs are processed and resubmitted. In emsusbclose() the URBs are freed by calling usbkillanchoredurbs(&dev->rxsubmitted).
However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in emsusbclose().
Fix the memory leak by anchoring the URB in the emsusbreadbulkcallback() to the dev->rxsubmitted anchor.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In ems_usb_read_bulk_callback(), anchor the URB to the dev->rx_submitted anchor before resubmitting it, so completed in-URBs are released by usb_kill_anchored_urbs(&dev->rx_submitted) in ems_usb_close().
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel ems_usb CAN-over-USB driver are exposed when the driver is opened and receives USB-IN transfers. The issue concerns URBs used for receive operations in that driver.
What conditions lead to the memory leak?
The leak occurs after an input URB completes: the USB framework removes it from the receive anchor before its completion callback runs. If the device is then closed, completed URBs that were not re-anchored are not released by usb_kill_anchored_urbs().
How does the fix prevent the leak?
The corrected completion callback anchors the URB back into dev->rx_submitted before it is resubmitted. This ensures ems_usb_close() can find and free completed receive URBs through the anchored-URB cleanup path.