CVE-2026-23080

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak

Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb:

gs_usb_receive_bulk_callback(): fix URB memory leak").

In mcba_usb_probe() -> mcba_usb_start(), the URBs for USB-in transfers are

allocated, added to the priv->rx_submitted anchor and submitted. In the

complete callback mcba_usb_read_bulk_callback(), the URBs are processed and

resubmitted. In mcba_usb_close() -> mcba_urb_unlink() the URBs are freed by

calling usb_kill_anchored_urbs(&priv->rx_submitted).

However, this does not take into account that the USB framework unanchors

the URB before the complete function is called. This means that once an

in-URB has been completed, it is no longer anchored and is ultimately not

released in usb_kill_anchored_urbs().

Fix the memory leak by anchoring the URB in the

mcba_usb_read_bulk_callback()to the priv->rx_submitted anchor.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References