The Linux kernel driver for the CAN device etas_es58x incorrectly treats partial allocation of USB Request Blocks (URBs) as a fatal error, allowing some URBs to remain allocated when the driver opens its interface. This results in a memory leak that can accumulate over time, potentially exhausting system resources and leading to a denial of service if the kernel runs out of memory for subsequent URB allocations.

Both Linux kernel variants that include the etas_es58x CAN driver are affected. No specific kernel version numbers are listed in the advisory, so all kernels containing the older implementation should be considered vulnerable until the patch is applied.

The EPSS score of less than 1% indicates a very low probability of exploitation. No exploits are publicly known, and the vulnerability has not been listed in the CISA KEV catalog. Because the issue results in a resource leak that could grow over time, an attacker who can repeatedly trigger the driver’s URB allocation path has the potential to exhaust kernel memory, leading to a denial of service. The severity is therefore primarily limited to systems that repeatedly use the etas_es58x driver or have high‑load USB environments.