Medium 5.5Published Mar 25, 2026

CVE-2026-23324can: usb: etas_es58x: correctly anchor the urb in the read bulk callback

Updated under an hour ago (Oct 26, 2026, 6:40 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: can: usb: etas_es58x: correctly anchor the urb in the read bulk callback When submitting an urb, that is using the anchor pattern, it needs to be anchored before submitting it otherwise it could be leaked if usb_kill_anchored_urbs() is called. This logic is correctly done elsewhere in the driver, except in the read bulk callback so do that here also.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	8537257874e949a59c834cecfd5a063e11b64b0b builds before 7a0171b4921ad443fee5ed4fcb9d99fa4776edac; 8537257874e949a59c834cecfd5a063e11b64b0b builds before 2185ea6e4ebcb61d1224dc7d187c59723cb5ad59; from 8537257874e949a59c834cecfd5a063e11b64b0b before f6e90c113c92e83fc0963d5e60e16b0e8a268981; from 8537257874e949a59c834cecfd5a063e11b64b0b before b878444519fa03a3edd287d1963cf79ef78be2f1; 8537257874e949a59c834cecfd5a063e11b64b0b builds before 18eee279e9b5bff0db1aca9475ae4bc12804f05c; from 8537257874e949a59c834cecfd5a063e11b64b0b before b8f9ca88253574638bcff38900a4c28d570b1919; 8537257874e949a59c834cecfd5a063e11b64b0b builds before 5eaad4f768266f1f17e01232ffe2ef009f8129b7	CNA record
linux linux_kernel linux:linux_kernel	from 5.13.1 before 5.15.203; from 5.16 before 6.1.167; from 6.2 before 6.6.130; from 6.7 before 6.12.77; from 6.13 before 6.18.17; from 6.19 before 6.19.7; 5.13; 7.0; and 6 more ranges	NVD

References

References

https://git.kernel.org/stable/c/7a0171b4921ad443fee5ed4fcb9d99fa4776edac	patch
https://git.kernel.org/stable/c/2185ea6e4ebcb61d1224dc7d187c59723cb5ad59	patch
https://git.kernel.org/stable/c/f6e90c113c92e83fc0963d5e60e16b0e8a268981	patch
https://git.kernel.org/stable/c/b878444519fa03a3edd287d1963cf79ef78be2f1	patch
https://git.kernel.org/stable/c/18eee279e9b5bff0db1aca9475ae4bc12804f05c	patch
https://git.kernel.org/stable/c/b8f9ca88253574638bcff38900a4c28d570b1919	patch
https://git.kernel.org/stable/c/5eaad4f768266f1f17e01232ffe2ef009f8129b7	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.