CVE-2026-23324

Vulnerability

In the Linux kernel's etas_es58x CAN USB driver, the read bulk callback does not anchor the URB (USB Request Block) before submitting it. The anchor pattern requires that a URB be anchored prior to submission; otherwise, a race condition can lead to the URB being leaked if usb_kill_ kill_anchored_urbs() is invoked concurrently. This oversight exists only in the read bulk callback, while other parts of the driver correctly anchor URBs first [1][2].

Exploitation

An attacker would need physical access to the USB bus or the ability to trigger USB device disconnection or reset events that cause usb_kill_anchored_urbs() to be called. No special privileges are required beyond the ability to interact with the affected USB device. The vulnerability is triggered during normal URB lifecycle management, not through a crafted packet [3][4].

Impact

If the URB is not anchored, a call to usb_kill_anchored_urbs() will not find it, leaving the URB in a state where it can be freed while still in use or never properly cleaned up. This can lead to a use-after-free or memory leak, potentially causing a denial of service (system crash or instability). The CVSS v3 score of 5.5 (Medium) reflects the requirement for physical access or local USB interaction [1][2].

Mitigation

The fix has been applied in the Linux kernel stable tree via commits that add the missing usb_anchor_urb() call before submission in the read bulk callback. Users should update to a kernel version containing these patches. No workaround is available other than applying the kernel update [3][4].