CVE-2026-23075: can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak
In the Linux kernel, the following vulnerability has been resolved:
can: esdusb: esdusbreadbulkcallback(): fix URB memory leak
Fix similar memory leak as in commit 7352e1d5932a ("can: gsusb: gsusbreceivebulkcallback(): fix URB memory leak").
In esdusbopen(), the URBs for USB-in transfers are allocated, added to the dev->rxsubmitted anchor and submitted. In the complete callback esdusbreadbulkcallback(), the URBs are processed and resubmitted. In esdusbclose() the URBs are freed by calling usbkillanchoredurbs(&dev->rxsubmitted).
However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in esdusbclose().
Fix the memory leak by anchoring the URB in the esdusbreadbulkcallback() to the dev->rxsubmitted anchor.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23075?
The severity of CVE-2026-23075 is medium, with a CVSS score of 5.5.
How do I fix CVE-2026-23075?
To fix CVE-2026-23075, apply the available patch provided for this vulnerability in the Linux kernel.
What does CVE-2026-23075 refer to?
CVE-2026-23075 refers to a memory leak vulnerability in the Linux kernel related to USB-in transfers.
What are the potential impacts of CVE-2026-23075?
The potential impact of CVE-2026-23075 includes a denial of service due to the memory leak.
Is there a patch available for CVE-2026-23075?
Yes, a patch is available to address the vulnerabilities associated with CVE-2026-23075.