CVE-2026-23058

Vulnerability

This vulnerability is a memory leak in the Linux kernel's ems_usb CAN driver, specifically in the ems_usb_read_bulk_callback() function [1]. The root cause is a mismatch between how USB request blocks (URBs) are managed during device open and close. In ems_usb_open(), URBs for USB-in transfers are allocated, anchored to the dev->rx_submitted anchor list, and submitted. When the device is closed via ems_usb_close(), the kernel calls usb_kill_anchored_urbs(&dev->rx_submitted), which is intended to free all anchored URBs. However, the USB framework unanchors a URB before its completion callback is invoked. This means that once a URB completes, it is removed from the anchor list, and ems_usb_close() no longer sees it, failing to free it.

Exploitation

To exploit this memory leak, an attacker would need local access to the system and the ability to repeatedly open and close the CAN interface [1]. This causes a continuous loss of memory as URBs are allocated but not freed. No additional privileges or special hardware beyond the EMS USB CAN device are required, though the system must have the vulnerable driver loaded.

Impact

The primary impact is a denial of service through memory exhaustion [1]. Over time, the unreleased URBs accumulate, consuming kernel memory and potentially leading to system instability or crashes. The attacker gains no code execution or privilege escalation.

Mitigation

A fix has been applied in the Linux kernel [2][3]. The patch re-anchors the URB in the ems_usb_read_bulk_callback() function, ensuring it remains on the anchor list and is properly freed when the device is closed. Users should update to a patched kernel version. No workaround is available without a kernel update.