The es58x driver in the Linux kernel fails to free a coherent USB transfer buffer when usb_submit_urb() returns an error during a receive URB resubmit. The leaked buffer is never released, so each failure consumes additional kernel memory. Because the driver operates in privileged kernel space, the leak can accumulate until system memory is exhausted, potentially causing a denial‑of‑service by degrading performance or triggering a crash.

This issue affects any Linux kernel that includes the can: etas_es58x USB driver. No specific kernel release is enumerated in the advisory, so any kernel revision prior to the commit that fixes the issue and that contains the es58x driver (either built in or loaded as a module) may be vulnerable. Operators should verify the kernel version and determine whether the es58x driver is active on their systems.

EPSS data indicates a low exploitation probability (< 1%), and the flaw is not listed in CISA KEV, indicating no publicly confirmed exploitation. The attack likely requires a USB device that repeatedly triggers URB submission failures – such as a malicious or defective peripheral connecting to the target machine. While there is no known exploit code, the risk is moderate; an attacker could induce the leak and eventually exhaust kernel memory, leading to a denial‑of‑service. The flaw does not provide remote code execution or privilege escalation.