CVE-2026-23031

Vulnerability

Description

The gs_usb driver for USB CAN adapters contains a memory leak in its URB (USB Request Block) management. In gs_can_open(), URBs for USB-in transfers are allocated, anchored to parent->rx_submitted, and submitted. When each URB completes, the USB framework unanchors it before invoking the callback gs_usb_receive_bulk_callback(). However, the callback does not re-anchor the URB, so it becomes detached. Subsequently, gs_can_close() frees only anchored URBs via usb_kill_anchored_urbs(), leaving completed URBs unfreed.

Exploitation

An attacker with local access and the ability to open and close the CAN device repeatedly can trigger the leak. Each cycle of opening and closing causes completed URBs to accumulate without being freed, progressively consuming kernel memory. No special privileges beyond access to the CAN device are required, as the driver is typically accessible to unprivileged users through the can subsystem.

Impact

The memory leak can lead to kernel memory exhaustion over time, resulting in system instability or denial of service (DoS). In extreme cases, the system may become unresponsive or crash due to inability to allocate memory for other processes.

Mitigation

The vulnerability is fixed in Linux kernel stable releases that include the commit re-anchoring the URB in the callback. Users should update to a patched kernel version. No workaround is available for systems that cannot be updated.