CVE-2026-23031

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak

In gs_can_open(), the URBs for USB-in transfers are allocated, added to the

parent->rx_submitted anchor and submitted. In the complete callback

gs_usb_receive_bulk_callback(), the URB is processed and resubmitted. In

gs_can_close() the URBs are freed by calling

usb_kill_anchored_urbs(parent->rx_submitted).

However, this does not take into account that the USB framework unanchors

the URB before the complete function is called. This means that once an

in-URB has been completed, it is no longer anchored and is ultimately not

released in gs_can_close().

Fix the memory leak by anchoring the URB in the

gs_usb_receive_bulk_callback() to the parent->rx_submitted anchor.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References