CVE-2026-23082
can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error
Reported by linux · Published February 4, 2026
In the Linux kernel, the following vulnerability has been resolved: can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error In commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak"), the URB was re-anchored before usb_submit_urb() in gs_usb_receive_bulk_callback() to prevent a leak of this URB during cleanup. However, this patch did not take into account that usb_submit_urb() could fail. The URB remains anchored and usb_kill_anchored_urbs(&parent->rx_submitted) in gs_can_close() loops infinitely since the anchor list never becomes empty. To fix the bug, unanchor the URB when an usb_submit_urb() error occurs, also print an info message.
EPSS 0.15% · 3.8th percentile
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| Linux | Linux | da01de754e455e2598a7f1ce4ff2078c4f0ecde1, ce4352057fc5a986c76ece90801b9755e7c6e56c, c610b550ccc0438d456dfe1df9f4f36254ccaae3, c3edc14da81a8d8398682f6e4ab819f09f37c0b7, aa8a8866c533a150be4763bcb27993603bd5426c, 79a6d1bfe1148bc921b8d7f3371a7fbce44e30f7, 6.18.8, 6.12.68 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | 9c151898cc259a7784be60ba38664f42ede39b31, ec5ccc2af9e5b045671f3f604b57512feda8bcc5, f905bcfa971edb89e398c98957838d8c6381c0c7 |
| Linux | Linux | 6.12.67, 6.18.7 |
| Linux | Linux | 6.18.7, 7352e1d5932a0e777e39fa4b619801191f57e603, 6.12.67 |
| linux | linux_kernel | 6.18.7, 6.12.67 |
Timeline
- Feb 4, 2026 CVE Published
- Feb 5, 2026 EPSS Score (30 in total, the first dated here)
- Feb 5, 2026 Security Advisory (130 in total, the first dated here)
- Mar 22, 2026 Coalition ESS Score (2 in total, the first dated here)
- Sep 26, 2026 Distribution Patch (128 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-23082
vulnetix vdb fixes CVE-2026-23082Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-23082/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart