Medium 5.5Published Feb 4, 2026

CVE-2026-23082can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error

Updated under an hour ago (Oct 27, 2026, 3:00 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error In commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak"), the URB was re-anchored before usb_submit_urb() in gs_usb_receive_bulk_callback() to prevent a leak of this URB during cleanup. However, this patch did not take into account that usb_submit_urb() could fail. The URB remains anchored and usb_kill_anchored_urbs(&parent->rx_submitted) in gs_can_close() loops infinitely since the anchor list never becomes empty. To fix the bug, unanchor the URB when an usb_submit_urb() error occurs, also print an info message.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 9c151898cc259a7784be60ba38664f42ede39b31 before da01de754e455e2598a7f1ce4ff2078c4f0ecde1; from ec5ccc2af9e5b045671f3f604b57512feda8bcc5 before aa8a8866c533a150be4763bcb27993603bd5426c; from f905bcfa971edb89e398c98957838d8c6381c0c7 before ce4352057fc5a986c76ece90801b9755e7c6e56c; from 08624b7206ddb9148eeffc2384ebda2c47b6d1e9 before c610b550ccc0438d456dfe1df9f4f36254ccaae3; from 9f669a38ca70839229b7ba0f851820850a2fe1f7 before c3edc14da81a8d8398682f6e4ab819f09f37c0b7; 7352e1d5932a0e777e39fa4b619801191f57e603 builds before 79a6d1bfe1148bc921b8d7f3371a7fbce44e30f7	CNA record
linux linux_kernel linux:linux_kernel	6.12.67; 6.18.7; 6.19	NVD

References

References

https://git.kernel.org/stable/c/da01de754e455e2598a7f1ce4ff2078c4f0ecde1
https://git.kernel.org/stable/c/aa8a8866c533a150be4763bcb27993603bd5426c	patch
https://git.kernel.org/stable/c/ce4352057fc5a986c76ece90801b9755e7c6e56c	patch
https://git.kernel.org/stable/c/c610b550ccc0438d456dfe1df9f4f36254ccaae3	patch
https://git.kernel.org/stable/c/c3edc14da81a8d8398682f6e4ab819f09f37c0b7	patch
https://git.kernel.org/stable/c/79a6d1bfe1148bc921b8d7f3371a7fbce44e30f7	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.