---
id: CVE-2026-23108
title: 'can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak

  Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb:
  gs_usb_receive_bulk_callback(): fix …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 0024d8ad1639e32d717445c69ca813fd19c2a91c <
    feb8243eaea7efd5279b19667d7189fd8654c87a
  - >-
    Linux >= 0024d8ad1639e32d717445c69ca813fd19c2a91c <
    ef6e608e5ee71eca0cd3475c737e684cef24f240
  - >-
    Linux >= 0024d8ad1639e32d717445c69ca813fd19c2a91c <
    60719661b4cbd7ffbed1a0e0fa3bbc82d8bd2be9
  - >-
    Linux >= 0024d8ad1639e32d717445c69ca813fd19c2a91c <
    59ff56992bba28051ad67cd8cc7b0edfe7280796
  - >-
    Linux >= 0024d8ad1639e32d717445c69ca813fd19c2a91c <
    ea4a98e924164586066b39f29bfcc7cc9da108cd
  - >-
    Linux >= 0024d8ad1639e32d717445c69ca813fd19c2a91c <
    07e9373739c6388af9d99797cdb2e79dbbcbe92b
  - >-
    Linux >= 0024d8ad1639e32d717445c69ca813fd19c2a91c <
    f7a980b3b8f80fe367f679da376cf76e800f9480
  - Linux 3.9
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-10T20:42:19.985708Z'
published: '2026-02-04'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T18:25:31.374Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23108'
references:
  - url: 'https://git.kernel.org/stable/c/feb8243eaea7efd5279b19667d7189fd8654c87a'
  - url: 'https://git.kernel.org/stable/c/ef6e608e5ee71eca0cd3475c737e684cef24f240'
  - url: 'https://git.kernel.org/stable/c/60719661b4cbd7ffbed1a0e0fa3bbc82d8bd2be9'
  - url: 'https://git.kernel.org/stable/c/59ff56992bba28051ad67cd8cc7b0edfe7280796'
  - url: 'https://git.kernel.org/stable/c/ea4a98e924164586066b39f29bfcc7cc9da108cd'
  - url: 'https://git.kernel.org/stable/c/07e9373739c6388af9d99797cdb2e79dbbcbe92b'
  - url: 'https://git.kernel.org/stable/c/f7a980b3b8f80fe367f679da376cf76e800f9480'
tags:
  - cve.org
epss: 0.00149
epssPercentile: 0.03673
ingestedAt: '2026-10-19T18:35:50.104Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak

Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb:
gs_usb_receive_bulk_callback(): fix URB memory leak").

In usb_8dev_open() -> usb_8dev_start(), the URBs for USB-in transfers are
allocated, added to the priv->rx_submitted anchor and submitted. In the
complete callback usb_8dev_read_bulk_callback(), the URBs are processed and
resubmitted. In usb_8dev_close() -> unlink_all_urbs() the URBs are freed by
calling usb_kill_anchored_urbs(&priv->rx_submitted).

However, this does not take into account that the USB framework unanchors
the URB before the complete function is called. This means that once an
in-URB has been completed, it is no longer anchored and is ultimately not
released in usb_kill_anchored_urbs().

Fix the memory leak by anchoring the URB in the
usb_8dev_read_bulk_callback() to the priv->rx_submitted anchor.

## Affected

- `Linux >= 0024d8ad1639e32d717445c69ca813fd19c2a91c < feb8243eaea7efd5279b19667d7189fd8654c87a`
- `Linux >= 0024d8ad1639e32d717445c69ca813fd19c2a91c < ef6e608e5ee71eca0cd3475c737e684cef24f240`
- `Linux >= 0024d8ad1639e32d717445c69ca813fd19c2a91c < 60719661b4cbd7ffbed1a0e0fa3bbc82d8bd2be9`
- `Linux >= 0024d8ad1639e32d717445c69ca813fd19c2a91c < 59ff56992bba28051ad67cd8cc7b0edfe7280796`
- `Linux >= 0024d8ad1639e32d717445c69ca813fd19c2a91c < ea4a98e924164586066b39f29bfcc7cc9da108cd`
- `Linux >= 0024d8ad1639e32d717445c69ca813fd19c2a91c < 07e9373739c6388af9d99797cdb2e79dbbcbe92b`
- `Linux >= 0024d8ad1639e32d717445c69ca813fd19c2a91c < f7a980b3b8f80fe367f679da376cf76e800f9480`
- `Linux 3.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.