Riskcovery

CVE-2026-23031

can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak

State
Published
Severity
Not scored
Published
Jan 31, 2026
Updated
Jun 2, 2026
Reserved
Jan 13, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak

In gs_can_open(), the URBs for USB-in transfers are allocated, added to the parent->rx_submitted anchor and submitted. In the complete callback gs_usb_receive_bulk_callback(), the URB is processed and resubmitted. In gs_can_close() the URBs are freed by calling usb_kill_anchored_urbs(parent->rx_submitted).

However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in gs_can_close().

Fix the memory leak by anchoring the URB in the gs_usb_receive_bulk_callback() to the parent->rx_submitted anchor.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • d08e973a77d128b25e01a08c34d89593fdf222da to before 9c151898cc259a7784be60ba38664f42ede39b31Affected
  • d08e973a77d128b25e01a08c34d89593fdf222da to before ec5ccc2af9e5b045671f3f604b57512feda8bcc5Affected
  • d08e973a77d128b25e01a08c34d89593fdf222da to before f905bcfa971edb89e398c98957838d8c6381c0c7Affected
  • d08e973a77d128b25e01a08c34d89593fdf222da to before 08624b7206ddb9148eeffc2384ebda2c47b6d1e9Affected
  • d08e973a77d128b25e01a08c34d89593fdf222da to before 9f669a38ca70839229b7ba0f851820850a2fe1f7Affected
  • d08e973a77d128b25e01a08c34d89593fdf222da to before 7352e1d5932a0e777e39fa4b619801191f57e603Affected
LinuxLinux
  • 3.16Affected
  • before 3.16Not affected
  • 5.15.203 through 5.15.*Not affected
  • 6.1.162 through 6.1.*Not affected
  • 6.6.122 through 6.6.*Not affected
  • 6.12.67 through 6.12.*Not affected
  • 6.18.7 through 6.18.*Not affected
  • 6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.