CVE-2026-23075

can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak

State: Published
Severity: Not scored
Published: Feb 4, 2026
Updated: May 11, 2026
Reserved: Jan 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak

Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak").

In esd_usb_open(), the URBs for USB-in transfers are allocated, added to the dev->rx_submitted anchor and submitted. In the complete callback esd_usb_read_bulk_callback(), the URBs are processed and resubmitted. In esd_usb_close() the URBs are freed by calling usb_kill_anchored_urbs(&dev->rx_submitted).

However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in esd_usb_close().

Fix the memory leak by anchoring the URB in the esd_usb_read_bulk_callback() to the dev->rx_submitted anchor.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	96d8e90382dc336b5de401164597edfdc2e8d9f1 to before 93b34d4ba7266030801a509c088ac77c0d7a12e9Affected 96d8e90382dc336b5de401164597edfdc2e8d9f1 to before dc934d96673992af8568664c1b58e13eb164010dAffected 96d8e90382dc336b5de401164597edfdc2e8d9f1 to before 92d26ce07ac3b7a850dc68c8d73d487b39c39b33Affected 96d8e90382dc336b5de401164597edfdc2e8d9f1 to before adec5e1f9c99fe079ec4c92cca3f1109a3e257c3Affected 96d8e90382dc336b5de401164597edfdc2e8d9f1 to before 9d1807b442fc3286b204f8e59981b10e743533ceAffected 96d8e90382dc336b5de401164597edfdc2e8d9f1 to before a9503ae43256e80db5cba9d449b238607164c51dAffected 96d8e90382dc336b5de401164597edfdc2e8d9f1 to before 5a4391bdc6c8357242f62f22069c865b792406b3Affected
LinuxLinux	2.6.36Affected before 2.6.36Not affected 5.10.249 through 5.10.Not affected 5.15.199 through 5.15.Not affected 6.1.162 through 6.1.Not affected 6.6.122 through 6.6.Not affected 6.12.68 through 6.12.Not affected 6.18.8 through 6.18.Not affected 6.19 and laterNot affected

Product

Versions

LinuxLinux

96d8e90382dc336b5de401164597edfdc2e8d9f1 to before 93b34d4ba7266030801a509c088ac77c0d7a12e9Affected
96d8e90382dc336b5de401164597edfdc2e8d9f1 to before dc934d96673992af8568664c1b58e13eb164010dAffected
96d8e90382dc336b5de401164597edfdc2e8d9f1 to before 92d26ce07ac3b7a850dc68c8d73d487b39c39b33Affected
96d8e90382dc336b5de401164597edfdc2e8d9f1 to before adec5e1f9c99fe079ec4c92cca3f1109a3e257c3Affected
96d8e90382dc336b5de401164597edfdc2e8d9f1 to before 9d1807b442fc3286b204f8e59981b10e743533ceAffected
96d8e90382dc336b5de401164597edfdc2e8d9f1 to before a9503ae43256e80db5cba9d449b238607164c51dAffected
96d8e90382dc336b5de401164597edfdc2e8d9f1 to before 5a4391bdc6c8357242f62f22069c865b792406b3Affected

LinuxLinux

2.6.36Affected
before 2.6.36Not affected
5.10.249 through 5.10.*Not affected
5.15.199 through 5.15.*Not affected
6.1.162 through 6.1.*Not affected
6.6.122 through 6.6.*Not affected
6.12.68 through 6.12.*Not affected
6.18.8 through 6.18.*Not affected
6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.