Not yet scoredPublished Feb 4, 2026

CVE-2026-23058can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak

Updated under an hour ago (Oct 28, 2026, 12:00 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak"). In ems_usb_open(), the URBs for USB-in transfers are allocated, added to the dev->rx_submitted anchor and submitted. In the complete callback ems_usb_read_bulk_callback(), the URBs are processed and resubmitted. In ems_usb_close() the URBs are freed by calling usb_kill_anchored_urbs(&dev->rx_submitted). However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in ems_usb_close(). Fix the memory leak by anchoring the URB in the ems_usb_read_bulk_callback() to the dev->rx_submitted anchor.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Deferred
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 702171adeed3607ee9603ec30ce081411e36ae42 before e2c71030dc464d437110bcfb367c493fd402bddb; from 702171adeed3607ee9603ec30ce081411e36ae42 before f48eabd15194b216030b32445f44230df95f5fe0; 702171adeed3607ee9603ec30ce081411e36ae42 builds before 61e6d3674c3d1da1475dc207b3e75c55d678d18e; from 702171adeed3607ee9603ec30ce081411e36ae42 before e9410fdd4d5f7eaa6526d8c80e83029d7c86a8e8; 702171adeed3607ee9603ec30ce081411e36ae42 builds before 46a191ff7eeec33a2ccb2a1bfea34e18fbc5dc1a; 702171adeed3607ee9603ec30ce081411e36ae42 builds before 68c62b3e53901846b5f68c5a8bade72a5d9c0b87; 702171adeed3607ee9603ec30ce081411e36ae42 builds before 0ce73a0eb5a27070957b67fd74059b6da89cc516	CNA record

References

References

https://git.kernel.org/stable/c/e2c71030dc464d437110bcfb367c493fd402bddb
https://git.kernel.org/stable/c/f48eabd15194b216030b32445f44230df95f5fe0
https://git.kernel.org/stable/c/61e6d3674c3d1da1475dc207b3e75c55d678d18e
https://git.kernel.org/stable/c/e9410fdd4d5f7eaa6526d8c80e83029d7c86a8e8
https://git.kernel.org/stable/c/46a191ff7eeec33a2ccb2a1bfea34e18fbc5dc1a
https://git.kernel.org/stable/c/68c62b3e53901846b5f68c5a8bade72a5d9c0b87
https://git.kernel.org/stable/c/0ce73a0eb5a27070957b67fd74059b6da89cc516

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.