Riskcovery

CVE-2026-23082

can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error

State
Published
Severity
Not scored
Published
Feb 4, 2026
Updated
May 11, 2026
Reserved
Jan 13, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error

In commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak"), the URB was re-anchored before usb_submit_urb() in gs_usb_receive_bulk_callback() to prevent a leak of this URB during cleanup.

However, this patch did not take into account that usb_submit_urb() could fail. The URB remains anchored and usb_kill_anchored_urbs(&parent->rx_submitted) in gs_can_close() loops infinitely since the anchor list never becomes empty.

To fix the bug, unanchor the URB when an usb_submit_urb() error occurs, also print an info message.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 9c151898cc259a7784be60ba38664f42ede39b31 to before da01de754e455e2598a7f1ce4ff2078c4f0ecde1Affected
  • ec5ccc2af9e5b045671f3f604b57512feda8bcc5 to before aa8a8866c533a150be4763bcb27993603bd5426cAffected
  • f905bcfa971edb89e398c98957838d8c6381c0c7 to before ce4352057fc5a986c76ece90801b9755e7c6e56cAffected
  • 08624b7206ddb9148eeffc2384ebda2c47b6d1e9 to before c610b550ccc0438d456dfe1df9f4f36254ccaae3Affected
  • 9f669a38ca70839229b7ba0f851820850a2fe1f7 to before c3edc14da81a8d8398682f6e4ab819f09f37c0b7Affected
  • 7352e1d5932a0e777e39fa4b619801191f57e603 to before 79a6d1bfe1148bc921b8d7f3371a7fbce44e30f7Affected
LinuxLinux
  • 6.12.67 to before 6.12.68Affected
  • 6.18.7 to before 6.18.8Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.