CVE-2026-23347

Vulnerability

The f81604 USB CAN driver in the Linux kernel does not anchor the URB before submitting it in the read bulk callback. According to the patch description, URBs using the anchor pattern must be anchored prior to submission; otherwise, they can be leaked if usb_kill_anchored_urbs() is invoked [1]. This oversight exists only in the read bulk path, as other parts of the driver correctly anchor URBs.

Exploitation

An attacker with physical access or the ability to trigger a USB device removal could cause the kernel to call usb_kill_anchored_urbs(). If the URB is not anchored, it will not be killed or freed, leading to a memory leak. No authentication is required; any scenario that triggers the read bulk callback (e.g., CAN frame reception) and then a device disconnect could expose the issue.

Impact

Successful exploitation results in a kernel memory leak. Repeated triggers could exhaust kernel memory, potentially leading to denial of service. The vulnerability is rated Medium (CVSS 5.5) with low attack complexity and no privileges required.

Mitigation

The fix has been backported to stable kernels via commit 952caa5da10b and related commits [1]. Users should update to the latest kernel versions containing this fix. No workarounds are available.