CVE-2026-23324: can: usb: etas_es58x: correctly anchor the urb in the read bulk callback
can: usb: etases58x: correctly anchor the urb in the read bulk callback
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.130.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In the can: usb: etas_es58x driver read bulk callback, anchor the URB before submitting it so usb_kill_anchored_urbs() cannot leak it.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel etas_es58x USB CAN driver are affected. The listed software also includes Microsoft azl3 kernel 6.6.126.1-1.
What access does an attacker need to exploit it?
The supplied CVSS vector indicates local access and low privileges are required. No user interaction is required.
What happens if the issue is triggered?
An URB can be leaked when usb_kill_anchored_urbs() is called because the read bulk callback submits it before anchoring it. The listed impact is high confidentiality impact, with no integrity or availability impact.
What should teams do to remediate the issue?
Apply the available patch. The referenced stable kernel commits contain the fix that anchors the URB before it is submitted in the read bulk callback.