LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23058: can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak

In the Linux kernel, the following vulnerability has been resolved: can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak"). In ems_usb_open(), the URBs for USB-in transfers are allocated, added to the dev->rx_submitted anchor and submitted. In the complete callback ems_usb_read_bulk_callback(), the URBs are processed and resubmitted. In ems_usb_close() the URBs are freed by calling usb_kill_anchored_urbs(&dev->rx_submitted). However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in ems_usb_close(). Fix the memory leak by anchoring the URB in the ems_usb_read_bulk_callback() to the dev->rx_submitted anchor.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2026-23058 is a Linux kernel memory leak in the EMS USB CAN driver. A completed USB receive request can become untracked and not freed when the device closes. Business impact is most relevant to systems using EMS USB CAN adapters, where repeated use could waste kernel memory and affect reliability.

Executive priority

Treat this as a targeted reliability risk, not a broad emergency. Patch through normal kernel maintenance, faster where EMS USB CAN devices support production, industrial, automotive, or lab operations.

Technical view

The flaw is in ems_usb_read_bulk_callback(). The USB framework unanchors an in-URB before the completion callback runs, so ems_usb_close() may not free that URB via usb_kill_anchored_urbs(). The fix re-anchors the URB to dev->rx_submitted in the callback, matching a similar gs_usb leak fix.

Likely exposure

Exposure appears limited to Linux systems with the CAN EMS USB driver path in use, typically hosts connected to EMS USB CAN hardware. The CVE record lists affected Linux kernel series and stable fix commits, but distro package status is not provided.

Exploitation context

The source bundle provides no CVSS score, CWE, public exploit claim, or KEV listing. There is no cited evidence of active exploitation. The described impact is a kernel memory leak, which is more likely to cause reliability or denial-of-service concerns than direct compromise.

Researcher notes

Key evidence is the kernel resolution note and stable commit references. The record does not provide exploitability detail, CVSS, distro package mappings, or proof of abuse, so exposure assessment depends on hardware and driver usage.

Mitigation direction

  • Update to a Linux kernel build containing the referenced stable fix commit.
  • Check distribution advisories for the exact patched kernel package version.
  • Prioritize systems using EMS USB CAN adapters or CAN bus workflows.
  • If patching is delayed, consult vendor guidance for temporary driver or device controls.

Validation and detection

  • Inventory Linux hosts using EMS USB CAN hardware or the ems_usb driver.
  • Compare running kernel builds against vendor advisories and referenced stable commits.
  • Confirm patched systems rebooted into the updated kernel.
  • Monitor affected hosts for abnormal kernel memory growth during CAN USB activity.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23058 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
8Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux702171adeed3607ee9603ec30ce081411e36ae42, 702171adeed3607ee9603ec30ce081411e36ae42, 702171adeed3607ee9603ec30ce081411e36ae42, 702171adeed3607ee9603ec30ce081411e36ae42, 702171adeed3607ee9603ec30ce081411e36ae42, 702171adeed3607ee9603ec30ce081411e36ae42, 702171adeed3607ee9603ec30ce081411e36ae42unaffected
LinuxLinux2.6.32, 0, 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.68, 6.18.8, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.