Medium 5.5Published Feb 4, 2026

CVE-2026-23075can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak

Updated under an hour ago (Oct 27, 2026, 8:40 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak"). In esd_usb_open(), the URBs for USB-in transfers are allocated, added to the dev->rx_submitted anchor and submitted. In the complete callback esd_usb_read_bulk_callback(), the URBs are processed and resubmitted. In esd_usb_close() the URBs are freed by calling usb_kill_anchored_urbs(&dev->rx_submitted). However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in esd_usb_close(). Fix the memory leak by anchoring the URB in the esd_usb_read_bulk_callback() to the dev->rx_submitted anchor.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	96d8e90382dc336b5de401164597edfdc2e8d9f1 builds before 93b34d4ba7266030801a509c088ac77c0d7a12e9; from 96d8e90382dc336b5de401164597edfdc2e8d9f1 before dc934d96673992af8568664c1b58e13eb164010d; 96d8e90382dc336b5de401164597edfdc2e8d9f1 builds before 92d26ce07ac3b7a850dc68c8d73d487b39c39b33; from 96d8e90382dc336b5de401164597edfdc2e8d9f1 before adec5e1f9c99fe079ec4c92cca3f1109a3e257c3; 96d8e90382dc336b5de401164597edfdc2e8d9f1 builds before 9d1807b442fc3286b204f8e59981b10e743533ce; from 96d8e90382dc336b5de401164597edfdc2e8d9f1 before a9503ae43256e80db5cba9d449b238607164c51d; 96d8e90382dc336b5de401164597edfdc2e8d9f1 builds before 5a4391bdc6c8357242f62f22069c865b792406b3	CNA record
linux linux_kernel linux:linux_kernel	from 2.6.36 before 5.10.249; from 5.11 before 5.15.199; from 5.16 before 6.1.162; from 6.2 before 6.6.122; from 6.7 before 6.12.68; from 6.13 before 6.18.8; 6.19; 6.19; and 4 more ranges	NVD

References

References

https://git.kernel.org/stable/c/93b34d4ba7266030801a509c088ac77c0d7a12e9	patch
https://git.kernel.org/stable/c/dc934d96673992af8568664c1b58e13eb164010d	patch
https://git.kernel.org/stable/c/92d26ce07ac3b7a850dc68c8d73d487b39c39b33	patch
https://git.kernel.org/stable/c/adec5e1f9c99fe079ec4c92cca3f1109a3e257c3	patch
https://git.kernel.org/stable/c/9d1807b442fc3286b204f8e59981b10e743533ce	patch
https://git.kernel.org/stable/c/a9503ae43256e80db5cba9d449b238607164c51d	patch
https://git.kernel.org/stable/c/5a4391bdc6c8357242f62f22069c865b792406b3	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.