CVE-2026-23324

can: usb: etas_es58x: correctly anchor the urb in the read bulk callback

State: Published
Severity: Not scored
Published: Mar 25, 2026
Updated: May 11, 2026
Reserved: Jan 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

can: usb: etas_es58x: correctly anchor the urb in the read bulk callback

When submitting an urb, that is using the anchor pattern, it needs to be anchored before submitting it otherwise it could be leaked if usb_kill_anchored_urbs() is called. This logic is correctly done elsewhere in the driver, except in the read bulk callback so do that here also.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	8537257874e949a59c834cecfd5a063e11b64b0b to before 7a0171b4921ad443fee5ed4fcb9d99fa4776edacAffected 8537257874e949a59c834cecfd5a063e11b64b0b to before 2185ea6e4ebcb61d1224dc7d187c59723cb5ad59Affected 8537257874e949a59c834cecfd5a063e11b64b0b to before f6e90c113c92e83fc0963d5e60e16b0e8a268981Affected 8537257874e949a59c834cecfd5a063e11b64b0b to before b878444519fa03a3edd287d1963cf79ef78be2f1Affected 8537257874e949a59c834cecfd5a063e11b64b0b to before 18eee279e9b5bff0db1aca9475ae4bc12804f05cAffected 8537257874e949a59c834cecfd5a063e11b64b0b to before b8f9ca88253574638bcff38900a4c28d570b1919Affected 8537257874e949a59c834cecfd5a063e11b64b0b to before 5eaad4f768266f1f17e01232ffe2ef009f8129b7Affected
LinuxLinux	5.13Affected before 5.13Not affected 5.15.203 through 5.15.Not affected 6.1.167 through 6.1.Not affected 6.6.130 through 6.6.Not affected 6.12.77 through 6.12.Not affected 6.18.17 through 6.18.Not affected 6.19.7 through 6.19.Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

8537257874e949a59c834cecfd5a063e11b64b0b to before 7a0171b4921ad443fee5ed4fcb9d99fa4776edacAffected
8537257874e949a59c834cecfd5a063e11b64b0b to before 2185ea6e4ebcb61d1224dc7d187c59723cb5ad59Affected
8537257874e949a59c834cecfd5a063e11b64b0b to before f6e90c113c92e83fc0963d5e60e16b0e8a268981Affected
8537257874e949a59c834cecfd5a063e11b64b0b to before b878444519fa03a3edd287d1963cf79ef78be2f1Affected
8537257874e949a59c834cecfd5a063e11b64b0b to before 18eee279e9b5bff0db1aca9475ae4bc12804f05cAffected
8537257874e949a59c834cecfd5a063e11b64b0b to before b8f9ca88253574638bcff38900a4c28d570b1919Affected
8537257874e949a59c834cecfd5a063e11b64b0b to before 5eaad4f768266f1f17e01232ffe2ef009f8129b7Affected

LinuxLinux

5.13Affected
before 5.13Not affected
5.15.203 through 5.15.*Not affected
6.1.167 through 6.1.*Not affected
6.6.130 through 6.6.*Not affected
6.12.77 through 6.12.*Not affected
6.18.17 through 6.18.*Not affected
6.19.7 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.