CVE-2026-23108: Linux kernel · can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in feb8243eaea7efd5279b19667d7189fd8654c87a : update Linux kernel when convenient.
Data as of 26 Oct 2026, 14:05 UTC
Rated by Threat Radar · No CVSS score from NVD or the CNA
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 4% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- CISA SSVC
- Exploitation
- No evidence of active exploitation and no public proof of concept
- Automatable
- Attackers cannot reliably automate steps 1–4 of the kill chain
- Technical impact
- Limited control over the software or limited information exposure
CISA SSVC assessment, 2026-06-10.
- Patch
- Available – fixed in feb8243eaea7efd5279b19667d7189fd8654c87a, f7a980b3b8f80fe367f679da376cf76e800f9480, ef6e608e5ee71eca0cd3475c737e684cef24f240 +4
Exploitation evidence
Disclosed: evidence found.
CVE published 4 Feb 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
Description
In the Linux kernel, the following vulnerability has been resolved: can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak"). In usb_8dev_open() -> usb_8dev_start(), the URBs for USB-in transfers are allocated, added to the priv->rx_submitted anchor and submitted. In the complete callback usb_8dev_read_bulk_callback(), the URBs are processed and resubmitted. In usb_8dev_close() -> unlink_all_urbs() the URBs are freed by calling usb_kill_anchored_urbs(&priv->rx_submitted). However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in usb_kill_anchored_urbs(). Fix the memory leak by anchoring the URB in the usb_8dev_read_bulk_callback() to the priv->rx_submitted anchor.
References
- git.kernel.org/stable/c/feb8243eaea7efd5279b19667d7189fd8654c87a (opens in a new tab)
- git.kernel.org/stable/c/ef6e608e5ee71eca0cd3475c737e684cef24f240 (opens in a new tab)
- git.kernel.org/stable/c/60719661b4cbd7ffbed1a0e0fa3bbc82d8bd2be9 (opens in a new tab)
- git.kernel.org/stable/c/59ff56992bba28051ad67cd8cc7b0edfe7280796 (opens in a new tab)
- git.kernel.org/stable/c/ea4a98e924164586066b39f29bfcc7cc9da108cd (opens in a new tab)
- git.kernel.org/stable/c/07e9373739c6388af9d99797cdb2e79dbbcbe92b (opens in a new tab)
- git.kernel.org/stable/c/f7a980b3b8f80fe367f679da376cf76e800f9480 (opens in a new tab)