CVE-2026-23075

can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak

Published Feb 4, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak

Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb:
gs_usb_receive_bulk_callback(): fix URB memory leak").

In esd_usb_open(), the URBs for USB-in transfers are allocated, added to
the dev->rx_submitted anchor and submitted. In the complete callback
esd_usb_read_bulk_callback(), the URBs are processed and resubmitted. In
esd_usb_close() the URBs are freed by calling
usb_kill_anchored_urbs(&dev->rx_submitted).

However, this does not take into account that the USB framework unanchors
the URB before the complete function is called. This means that once an
in-URB has been completed, it is no longer anchored and is ultimately not
released in esd_usb_close().

Fix the memory leak by anchoring the URB in the
esd_usb_read_bulk_callback() to the dev->rx_submitted anchor.

Analysis

Technical impact

The Linux kernel esd_usb driver can leak memory when completed USB read requests are not properly anchored, causing unused URBs to remain allocated and eventually exhausting RAM. This vulnerability does not directly facilitate arbitrary code execution or data disclosure, but it can degrade system stability and availability by leading to a local denial‑of‑service condition. The weakness is classified as a memory leak (CWE-401).

Affected Systems

The flaw exists in the esd_usb driver of the Linux kernel, which handles CAN-over-USB. The driver is included in all kernel versions beginning with the 6.19 release candidates, but the exact versions are not specified by the CNA. Systems running these kernels without the fix are susceptible.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity. EPSS data shows a probability of exploitability below 1%, meaning the likelihood of real‑world exploitation is low, and the vulnerability is not in the CISA KEV catalog. The attack vector is inferred to be local: an attacker with physical or administrative access to a USB ESD device must succeed. Exploitation requires the driver to process USB read traffic enough to accumulate unreleased URBs; no privilege escalation or remote code theft is involved.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`96d8e90382dc336b5de401164597edfdc2e8d9f1`	affected	< 93b34d4ba7266030801a509c088ac77c0d7a12e9
`96d8e90382dc336b5de401164597edfdc2e8d9f1`	affected	< dc934d96673992af8568664c1b58e13eb164010d
`96d8e90382dc336b5de401164597edfdc2e8d9f1`	affected	< 92d26ce07ac3b7a850dc68c8d73d487b39c39b33
`96d8e90382dc336b5de401164597edfdc2e8d9f1`	affected	< adec5e1f9c99fe079ec4c92cca3f1109a3e257c3
`96d8e90382dc336b5de401164597edfdc2e8d9f1`	affected	< 9d1807b442fc3286b204f8e59981b10e743533ce
`96d8e90382dc336b5de401164597edfdc2e8d9f1`	affected	< a9503ae43256e80db5cba9d449b238607164c51d
`96d8e90382dc336b5de401164597edfdc2e8d9f1`	affected	< 5a4391bdc6c8357242f62f22069c865b792406b3

Linux

affected

Version	Status	Constraints
`2.6.36`	affected	—
`0`	unaffected	< 2.6.36
`5.10.249`	unaffected	≤ 5.10.*
`5.15.199`	unaffected	≤ 5.15.*
`6.1.162`	unaffected	≤ 6.1.*
`6.6.122`	unaffected	≤ 6.6.*
`6.12.68`	unaffected	≤ 6.12.*
`6.18.8`	unaffected	≤ 6.18.*
`6.19`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc1::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc2::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc3::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc4::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc5::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc6::::::

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a version that incorporates the esd_usb memory‑leak fix (e.g., the commit referenced in the advisory).
Restart the system or reload the esd_usb module to ensure the new code takes effect.
Limit physical and user access to USB ESD devices and monitor memory usage to detect persistent leaks.

Generated by OpenCVE AI on April 18, 2026 at 18:29 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4475-1	linux security update
Debian DLA	DLA-4476-1	linux-6.1 security update
Debian DSA	DSA-6126-1	linux security update
Debian DSA	DSA-6127-1	linux security update
Ubuntu USN	USN-8162-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8180-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8180-2	Linux kernel (FIPS) vulnerabilities
Ubuntu USN	USN-8186-1	Linux kernel (Real-time) vulnerabilities
Ubuntu USN	USN-8187-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8188-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-8180-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8180-4	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8180-5	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8243-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8180-6	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8275-1	Linux kernel (Xilinx ZynqMP) vulnerabilities
Ubuntu USN	USN-8278-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8289-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8296-1	Linux kernel (FIPS) vulnerabilities
Ubuntu USN	USN-8297-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8296-2	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8278-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8440-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8499-1	Linux kernel (Xilinx) vulnerabilities
Ubuntu USN	USN-8570-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8594-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8604-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8605-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8570-2	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8289-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8393-1	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8669-1	Linux kernel (NVIDIA) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.147% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/5a4391bdc6c8357242f62f22069c865b792406b3
https://git.kernel.org/stable/c/92d26ce07ac3b7a850dc68c8d73d487b39c39b33
https://git.kernel.org/stable/c/93b34d4ba7266030801a509c088ac77c0d7a12e9
https://git.kernel.org/stable/c/9d1807b442fc3286b204f8e59981b10e743533ce
https://git.kernel.org/stable/c/a9503ae43256e80db5cba9d449b238607164c51d
https://git.kernel.org/stable/c/adec5e1f9c99fe079ec4c92cca3f1109a3e257c3
https://git.kernel.org/stable/c/dc934d96673992af8568664c1b58e13eb164010d
https://lore.kernel.org/linux-cve-announce/2026020419-CVE-2026-23075-0aef@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-23075
https://www.cve.org/CVERecord?id=CVE-2026-23075

History

Mar 18, 2026 5:30 PM Weaknesses updated. Affected versions updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-401
CPEs		cpe:2.3:o:linux:linux_kernel:6.19:rc1:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc2:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc3:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc4:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc5:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc6::::::
Metrics		cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

Feb 6, 2026 4:45 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/92d26ce07ac3b7a850dc68c8d73d487b39c39b33 https://git.kernel.org/stable/c/93b34d4ba7266030801a509c088ac77c0d7a12e9 https://git.kernel.org/stable/c/dc934d96673992af8568664c1b58e13eb164010d

Feb 5, 2026 12:15 AM Added references View changes

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026020419-CVE-2026-23075-0aef@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-23075 https://www.cve.org/CVERecord?id=CVE-2026-23075

Feb 4, 2026 4:30 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak"). In esd_usb_open(), the URBs for USB-in transfers are allocated, added to the dev->rx_submitted anchor and submitted. In the complete callback esd_usb_read_bulk_callback(), the URBs are processed and resubmitted. In esd_usb_close() the URBs are freed by calling usb_kill_anchored_urbs(&dev->rx_submitted). However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in esd_usb_close(). Fix the memory leak by anchoring the URB in the esd_usb_read_bulk_callback() to the dev->rx_submitted anchor.
Title		can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/5a4391bdc6c8357242f62f22069c865b792406b3 https://git.kernel.org/stable/c/9d1807b442fc3286b204f8e59981b10e743533ce https://git.kernel.org/stable/c/a9503ae43256e80db5cba9d449b238607164c51d https://git.kernel.org/stable/c/adec5e1f9c99fe079ec4c92cca3f1109a3e257c3