In the Linux kernel, the following vulnerability has been resolved:

net: usb: pegasus: fix memory leak in update_eth_regs_async()

When asynchronously writing to the device registers and if usb_submit_urb()
fail, the code fail to release allocated to this point resources.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00035.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
323b34963d113efb566635f43858f40cce01d5f9 affected
< 5397ea6d21c35a17707e201a60761bdee00bcc4e
323b34963d113efb566635f43858f40cce01d5f9 affected
< a40af9a2904a1ab8ce61866ebe2a894ef30754ba
323b34963d113efb566635f43858f40cce01d5f9 affected
< ac5d92d2826dec51e5d4c6854865bc5817277452
323b34963d113efb566635f43858f40cce01d5f9 affected
< 93f18eaa190374e0f2d253e3b1a65cee19a7abe6
323b34963d113efb566635f43858f40cce01d5f9 affected
< 471dfb97599eec74e0476046b3ef8e7037f27b34
323b34963d113efb566635f43858f40cce01d5f9 affected
< ce6eef731aba23a988decea1df3b08cf978f7b01
323b34963d113efb566635f43858f40cce01d5f9 affected
< afa27621a28af317523e0836dad430bec551eb54
Linux Linux affected
Version Status Constraints
3.10 affected
—
0 unaffected
< 3.10
5.10.248 unaffected
≤ 5.10.*
5.15.198 unaffected
≤ 5.15.*
6.1.161 unaffected
≤ 6.1.*
6.6.121 unaffected
≤ 6.6.*
6.12.66 unaffected
≤ 6.12.*
6.18.6 unaffected
≤ 6.18.*
6.19 unaffected
≤ *

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:3.10:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*

No data.

No data.

Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4475-1 linux security update
Debian DLA Debian DLA DLA-4476-1 linux-6.1 security update
Debian DSA Debian DSA DSA-6126-1 linux security update
Debian DSA Debian DSA DSA-6127-1 linux security update
Ubuntu USN Ubuntu USN USN-8096-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8096-2 Linux kernel (FIPS) vulnerabilities
Ubuntu USN Ubuntu USN USN-8096-3 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8096-4 Linux kernel (Real-time) vulnerabilities
Ubuntu USN Ubuntu USN USN-8096-5 Linux kernel (NVIDIA Tegra IGX) vulnerabilities
Ubuntu USN Ubuntu USN USN-8116-1 Linux kernel (Intel IoTG Real-time) vulnerabilities
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/471dfb97599eec74e0476046b3ef8e7037f27b34 cve-icon cve-icon
https://git.kernel.org/stable/c/5397ea6d21c35a17707e201a60761bdee00bcc4e cve-icon cve-icon
https://git.kernel.org/stable/c/93f18eaa190374e0f2d253e3b1a65cee19a7abe6 cve-icon cve-icon
https://git.kernel.org/stable/c/a40af9a2904a1ab8ce61866ebe2a894ef30754ba cve-icon cve-icon
https://git.kernel.org/stable/c/ac5d92d2826dec51e5d4c6854865bc5817277452 cve-icon cve-icon
https://git.kernel.org/stable/c/afa27621a28af317523e0836dad430bec551eb54 cve-icon cve-icon
https://git.kernel.org/stable/c/ce6eef731aba23a988decea1df3b08cf978f7b01 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2026013136-CVE-2026-23021-8fc2@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-23021 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-23021 cve-icon
History

Wed, 25 Mar 2026 16:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-401
CPEs cpe:2.3:o:linux:linux_kernel:3.10:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Mon, 02 Feb 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Important

Sat, 31 Jan 2026 11:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: net: usb: pegasus: fix memory leak in update_eth_regs_async() When asynchronously writing to the device registers and if usb_submit_urb() fail, the code fail to release allocated to this point resources.
Title net: usb: pegasus: fix memory leak in update_eth_regs_async()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-02-09T08:37:14.933Z

Reserved: 2026-01-13T15:37:45.941Z

Link: CVE-2026-23021

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-01-31T12:16:05.413

Modified: 2026-03-25T15:56:19.390

Link: CVE-2026-23021

cve-icon Redhat

Severity : Important

Publid Date: 2026-01-31T00:00:00Z

Links: CVE-2026-23021 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses