LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23075: can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak

In the Linux kernel, the following vulnerability has been resolved: can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak"). In esd_usb_open(), the URBs for USB-in transfers are allocated, added to the dev->rx_submitted anchor and submitted. In the complete callback esd_usb_read_bulk_callback(), the URBs are processed and resubmitted. In esd_usb_close() the URBs are freed by calling usb_kill_anchored_urbs(&dev->rx_submitted). However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in esd_usb_close(). Fix the memory leak by anchoring the URB in the esd_usb_read_bulk_callback() to the dev->rx_submitted anchor.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

CVE-2026-23075 is a Linux kernel memory leak in the esd_usb CAN USB driver. Affected systems may gradually lose kernel memory when the driver handles USB receive transfers. The public record does not provide CVSS scoring, confirmed exploitation, or broader impact beyond the leak.

Executive priority

Treat as a targeted maintenance issue, not an emergency, unless CAN USB systems are operationally critical. Patch through normal kernel update cycles, prioritizing industrial, lab, automotive, or embedded hosts that use esd_usb devices.

Technical view

The esd_usb receive callback processes and resubmits USB-in URBs, but completed URBs are unanchored by the USB framework before the callback runs. esd_usb_close() later frees only anchored URBs, leaving completed receive URBs unreleased. The fix reanchors the URB in esd_usb_read_bulk_callback().

Likely exposure

Exposure appears limited to Linux systems using the esd_usb CAN USB driver, especially hosts connected to ESD CAN-over-USB hardware. Generic Linux servers without this driver or hardware are less likely to be exposed.

Exploitation context

The bundle marks KEV as false and provides no cited evidence of active exploitation or public weaponization. The described weakness is a resource leak, most relevant to local device use or environments where the affected driver is exercised repeatedly.

Researcher notes

Evidence is limited to the CVE record and Linux stable commit references. No CVSS, CWE, exploit confirmation, or distro-specific package status is supplied. Validate exposure by driver usage and kernel backport state rather than kernel version alone.

Mitigation direction

  • Apply Linux kernel updates containing the referenced stable fixes.
  • Check distribution advisories for backported fixes for CVE-2026-23075.
  • Prioritize systems using esd_usb CAN USB hardware or modules.
  • If patching is delayed, follow vendor guidance on reducing use of the affected driver.

Validation and detection

  • Inventory Linux kernel versions against vendor-fixed releases and backports.
  • Identify systems using esd_usb CAN USB hardware or driver modules.
  • Review kernel changelogs for CVE-2026-23075 or the referenced stable commits.
  • After updating, regression-test CAN USB functionality and monitor kernel memory behavior.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23075 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
8Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux96d8e90382dc336b5de401164597edfdc2e8d9f1, 96d8e90382dc336b5de401164597edfdc2e8d9f1, 96d8e90382dc336b5de401164597edfdc2e8d9f1, 96d8e90382dc336b5de401164597edfdc2e8d9f1, 96d8e90382dc336b5de401164597edfdc2e8d9f1, 96d8e90382dc336b5de401164597edfdc2e8d9f1, 96d8e90382dc336b5de401164597edfdc2e8d9f1unaffected
LinuxLinux2.6.36, 0, 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.68, 6.18.8, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.