CVE-2026-23061

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak

Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb:

gs_usb_receive_bulk_callback(): fix URB memory leak").

In kvaser_usb_set_{,data_}bittiming() -> kvaser_usb_setup_rx_urbs(), the

URBs for USB-in transfers are allocated, added to the dev->rx_submitted

anchor and submitted. In the complete callback

kvaser_usb_read_bulk_callback(), the URBs are processed and resubmitted. In

kvaser_usb_remove_interfaces() the URBs are freed by calling

usb_kill_anchored_urbs(&dev->rx_submitted).

However, this does not take into account that the USB framework unanchors

the URB before the complete function is called. This means that once an

in-URB has been completed, it is no longer anchored and is ultimately not

released in usb_kill_anchored_urbs().

Fix the memory leak by anchoring the URB in the

kvaser_usb_read_bulk_callback() to the dev->rx_submitted a

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References