CVE-2026-23080

MEDIUM EPSS 2.4%
Published Feb 4, 20264mo ago · Modified Jun 17, 20262w ago
5.5 CVSS 3.1
Medium
Find Similar
Published Feb 4, 2026 4mo ago
Last Modified Jun 17, 2026 2w ago

Description

In the Linux kernel, the following vulnerability has been resolved: can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak"). In mcba_usb_probe() -> mcba_usb_start(), the URBs for USB-in transfers are allocated, added to the priv->rx_submitted anchor and submitted. In the complete callback mcba_usb_read_bulk_callback(), the URBs are processed and resubmitted. In mcba_usb_close() -> mcba_urb_unlink() the URBs are freed by calling usb_kill_anchored_urbs(&priv->rx_submitted). However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in usb_kill_anchored_urbs(). Fix the memory leak by anchoring the URB in the mcba_usb_read_bulk_callback()to the priv->rx_submitted anchor.

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
2.4% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-401

Affected Products 12

VendorProductVersionRange
linuxlinux_kernel*≥4.12  –  <5.10.249
linuxlinux_kernel*≥5.11  –  <5.15.199
linuxlinux_kernel*≥5.16  –  <6.1.162
linuxlinux_kernel*≥6.2  –  <6.6.122
linuxlinux_kernel*≥6.7  –  <6.12.68
linuxlinux_kernel*≥6.13  –  <6.18.8
linuxlinux_kernel6.19any
linuxlinux_kernel6.19any
linuxlinux_kernel6.19any
linuxlinux_kernel6.19any
linuxlinux_kernel6.19any
linuxlinux_kernel6.19any

References 7

  • git.kernel.org https://git.kernel.org/stable/c/179f6f0cf5ae489743273b7c1644324c0c477ea9
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/59153b6388e05609144ad56a9b354e9100a91983
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/710a7529fb13c5a470258ff5508ed3c498d54729
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/8b34c611a4feb81921bc4728c091e4e3ba0270c0
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/94c9f6f7b953f6382fef4bdc48c046b861b8868f
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/b5a1ccdc63b71d93a69a6b72f7a3f3934293ea60
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/d374d715e338dfc3804aaa006fa6e470ffebb264
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/179f6f0cf5ae489743273b7c1644324c0c477ea9
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/59153b6388e05609144ad56a9b354e9100a91983
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/710a7529fb13c5a470258ff5508ed3c498d54729
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/8b34c611a4feb81921bc4728c091e4e3ba0270c0
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/94c9f6f7b953f6382fef4bdc48c046b861b8868f
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/b5a1ccdc63b71d93a69a6b72f7a3f3934293ea60
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/d374d715e338dfc3804aaa006fa6e470ffebb264
    Patch