The gs_usb driver manages CAN bus devices over USB. Its bulk‑transfer routine allocates URBs, submits them, and processes them in gs_usb_receive_bulk_callback. When a URB completes, the USB subsystem removes it from the anchored list before invoking the callback, but the callback then resubmits the URB without re‑anchoring it. The URB is therefore never freed by gs_can_close, leading to a memory leak that grows with each transfer. Over time this can exhaust kernel memory, causing out‑of‑memory situations and potentially destabilizing the operating system. This flaw is a resource‑management weakness (CWE‑401).

All Linux kernel versions that embed the gs_usb CAN USB driver and have not incorporated the commit that re‑anchors pending URBs are affected. That includes mainline kernels and distributions that ship the unpatched gs_usb module. Any kernel before the fix remains vulnerable, regardless of distribution or patch level.

The CVSS score of 7.0 points to high severity, while the EPSS rank of less than 1 % indicates a low probability of exploitation. Exploitation requires the system to process repeated USB bulk transfers to a CAN device, which typically means the device must be physically connected or an attacker must have privileged access. There is no remote code execution or elevation of privilege path documented, so the attack vector is inferred to be local device‑based.