---
id: CVE-2026-23021
title: 'net: usb: pegasus: fix memory leak in update_eth_regs_async()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: usb: pegasus: fix memory leak in update_eth_regs_async()

  When asynchronously writing to the device registers and if usb_submit_urb()
  fail, the code fail to releas…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 323b34963d113efb566635f43858f40cce01d5f9 <
    5397ea6d21c35a17707e201a60761bdee00bcc4e
  - >-
    Linux >= 323b34963d113efb566635f43858f40cce01d5f9 <
    a40af9a2904a1ab8ce61866ebe2a894ef30754ba
  - >-
    Linux >= 323b34963d113efb566635f43858f40cce01d5f9 <
    ac5d92d2826dec51e5d4c6854865bc5817277452
  - >-
    Linux >= 323b34963d113efb566635f43858f40cce01d5f9 <
    93f18eaa190374e0f2d253e3b1a65cee19a7abe6
  - >-
    Linux >= 323b34963d113efb566635f43858f40cce01d5f9 <
    471dfb97599eec74e0476046b3ef8e7037f27b34
  - >-
    Linux >= 323b34963d113efb566635f43858f40cce01d5f9 <
    ce6eef731aba23a988decea1df3b08cf978f7b01
  - >-
    Linux >= 323b34963d113efb566635f43858f40cce01d5f9 <
    afa27621a28af317523e0836dad430bec551eb54
  - Linux 3.10
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-10T20:41:03.342469Z'
published: '2026-01-31'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T18:25:28.106Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23021'
references:
  - url: 'https://git.kernel.org/stable/c/5397ea6d21c35a17707e201a60761bdee00bcc4e'
  - url: 'https://git.kernel.org/stable/c/a40af9a2904a1ab8ce61866ebe2a894ef30754ba'
  - url: 'https://git.kernel.org/stable/c/ac5d92d2826dec51e5d4c6854865bc5817277452'
  - url: 'https://git.kernel.org/stable/c/93f18eaa190374e0f2d253e3b1a65cee19a7abe6'
  - url: 'https://git.kernel.org/stable/c/471dfb97599eec74e0476046b3ef8e7037f27b34'
  - url: 'https://git.kernel.org/stable/c/ce6eef731aba23a988decea1df3b08cf978f7b01'
  - url: 'https://git.kernel.org/stable/c/afa27621a28af317523e0836dad430bec551eb54'
tags:
  - cve.org
epss: 0.00175
epssPercentile: 0.06584
ingestedAt: '2026-10-19T18:35:50.110Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: usb: pegasus: fix memory leak in update_eth_regs_async()

When asynchronously writing to the device registers and if usb_submit_urb()
fail, the code fail to release allocated to this point resources.

## Affected

- `Linux >= 323b34963d113efb566635f43858f40cce01d5f9 < 5397ea6d21c35a17707e201a60761bdee00bcc4e`
- `Linux >= 323b34963d113efb566635f43858f40cce01d5f9 < a40af9a2904a1ab8ce61866ebe2a894ef30754ba`
- `Linux >= 323b34963d113efb566635f43858f40cce01d5f9 < ac5d92d2826dec51e5d4c6854865bc5817277452`
- `Linux >= 323b34963d113efb566635f43858f40cce01d5f9 < 93f18eaa190374e0f2d253e3b1a65cee19a7abe6`
- `Linux >= 323b34963d113efb566635f43858f40cce01d5f9 < 471dfb97599eec74e0476046b3ef8e7037f27b34`
- `Linux >= 323b34963d113efb566635f43858f40cce01d5f9 < ce6eef731aba23a988decea1df3b08cf978f7b01`
- `Linux >= 323b34963d113efb566635f43858f40cce01d5f9 < afa27621a28af317523e0836dad430bec551eb54`
- `Linux 3.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.