CVE-2026-23058

can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak

State: Published
Severity: Not scored
Published: Feb 4, 2026
Updated: May 11, 2026
Reserved: Jan 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak

Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak").

In ems_usb_open(), the URBs for USB-in transfers are allocated, added to the dev->rx_submitted anchor and submitted. In the complete callback ems_usb_read_bulk_callback(), the URBs are processed and resubmitted. In ems_usb_close() the URBs are freed by calling usb_kill_anchored_urbs(&dev->rx_submitted).

However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in ems_usb_close().

Fix the memory leak by anchoring the URB in the ems_usb_read_bulk_callback() to the dev->rx_submitted anchor.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	702171adeed3607ee9603ec30ce081411e36ae42 to before e2c71030dc464d437110bcfb367c493fd402bddbAffected 702171adeed3607ee9603ec30ce081411e36ae42 to before f48eabd15194b216030b32445f44230df95f5fe0Affected 702171adeed3607ee9603ec30ce081411e36ae42 to before 61e6d3674c3d1da1475dc207b3e75c55d678d18eAffected 702171adeed3607ee9603ec30ce081411e36ae42 to before e9410fdd4d5f7eaa6526d8c80e83029d7c86a8e8Affected 702171adeed3607ee9603ec30ce081411e36ae42 to before 46a191ff7eeec33a2ccb2a1bfea34e18fbc5dc1aAffected 702171adeed3607ee9603ec30ce081411e36ae42 to before 68c62b3e53901846b5f68c5a8bade72a5d9c0b87Affected 702171adeed3607ee9603ec30ce081411e36ae42 to before 0ce73a0eb5a27070957b67fd74059b6da89cc516Affected
LinuxLinux	2.6.32Affected before 2.6.32Not affected 5.10.249 through 5.10.Not affected 5.15.199 through 5.15.Not affected 6.1.162 through 6.1.Not affected 6.6.122 through 6.6.Not affected 6.12.68 through 6.12.Not affected 6.18.8 through 6.18.Not affected 6.19 and laterNot affected

Product

Versions

LinuxLinux

702171adeed3607ee9603ec30ce081411e36ae42 to before e2c71030dc464d437110bcfb367c493fd402bddbAffected
702171adeed3607ee9603ec30ce081411e36ae42 to before f48eabd15194b216030b32445f44230df95f5fe0Affected
702171adeed3607ee9603ec30ce081411e36ae42 to before 61e6d3674c3d1da1475dc207b3e75c55d678d18eAffected
702171adeed3607ee9603ec30ce081411e36ae42 to before e9410fdd4d5f7eaa6526d8c80e83029d7c86a8e8Affected
702171adeed3607ee9603ec30ce081411e36ae42 to before 46a191ff7eeec33a2ccb2a1bfea34e18fbc5dc1aAffected
702171adeed3607ee9603ec30ce081411e36ae42 to before 68c62b3e53901846b5f68c5a8bade72a5d9c0b87Affected
702171adeed3607ee9603ec30ce081411e36ae42 to before 0ce73a0eb5a27070957b67fd74059b6da89cc516Affected

LinuxLinux

2.6.32Affected
before 2.6.32Not affected
5.10.249 through 5.10.*Not affected
5.15.199 through 5.15.*Not affected
6.1.162 through 6.1.*Not affected
6.6.122 through 6.6.*Not affected
6.12.68 through 6.12.*Not affected
6.18.8 through 6.18.*Not affected
6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.