CVE-2026-23037

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23037", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.943Z", "datePublished": "2026-01-31T11:42:31.689Z", "dateUpdated": "2026-06-02T13:00:55.620Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T21:58:46.896Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: etas_es58x: allow partial RX URB allocation to succeed\n\nWhen es58x_alloc_rx_urbs() fails to allocate the requested number of\nURBs but succeeds in allocating some, it returns an error code.\nThis causes es58x_open() to return early, skipping the cleanup label\n'free_urbs', which leads to the anchored URBs being leaked.\n\nAs pointed out by maintainer Vincent Mailhol, the driver is designed\nto handle partial URB allocation gracefully. Therefore, partial\nallocation should not be treated as a fatal error.\n\nModify es58x_alloc_rx_urbs() to return 0 if at least one URB has been\nallocated, restoring the intended behavior and preventing the leak\nin es58x_open()."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/can/usb/etas_es58x/es58x_core.c"], "versions": [{"version": "8537257874e949a59c834cecfd5a063e11b64b0b", "lessThan": "97250eb05e4b6afe787290e8fd97d0675116c61b", "status": "affected", "versionType": "git"}, {"version": "8537257874e949a59c834cecfd5a063e11b64b0b", "lessThan": "aec888f44853584b5a7cd01249806030cf94a73d", "status": "affected", "versionType": "git"}, {"version": "8537257874e949a59c834cecfd5a063e11b64b0b", "lessThan": "611e839d2d552416b498ed5593e10670f61fcd4d", "status": "affected", "versionType": "git"}, {"version": "8537257874e949a59c834cecfd5a063e11b64b0b", "lessThan": "ba45e3d6b02c97dbb4578fbae7027fd66f3caa10", "status": "affected", "versionType": "git"}, {"version": "8537257874e949a59c834cecfd5a063e11b64b0b", "lessThan": "6c5124a60989051799037834f0a1a4b428718157", "status": "affected", "versionType": "git"}, {"version": "8537257874e949a59c834cecfd5a063e11b64b0b", "lessThan": "b1979778e98569c1e78c2c7f16bb24d76541ab00", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/can/usb/etas_es58x/es58x_core.c"], "versions": [{"version": "5.13", "status": "affected"}, {"version": "0", "lessThan": "5.13", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.199", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.162", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.122", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.67", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.7", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "5.15.199"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.1.162"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.6.122"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.12.67"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.18.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.19"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/97250eb05e4b6afe787290e8fd97d0675116c61b"}, {"url": "https://git.kernel.org/stable/c/aec888f44853584b5a7cd01249806030cf94a73d"}, {"url": "https://git.kernel.org/stable/c/611e839d2d552416b498ed5593e10670f61fcd4d"}, {"url": "https://git.kernel.org/stable/c/ba45e3d6b02c97dbb4578fbae7027fd66f3caa10"}, {"url": "https://git.kernel.org/stable/c/6c5124a60989051799037834f0a1a4b428718157"}, {"url": "https://git.kernel.org/stable/c/b1979778e98569c1e78c2c7f16bb24d76541ab00"}], "title": "can: etas_es58x: allow partial RX URB allocation to succeed", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-06-02T13:00:55.620Z"}, "affected": [{"vendor": "Siemens", "product": "RUGGEDCOM RST2428P", "versions": [{"status": "affected", "version": "0", "lessThan": "V4.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"}]}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/can/usb/etas_es58x/es58x_core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "97250eb05e4b6afe787290e8fd97d0675116c61b", "status": "affected", "version": "8537257874e949a59c834cecfd5a063e11b64b0b", "versionType": "git"}, {"lessThan": "aec888f44853584b5a7cd01249806030cf94a73d", "status": "affected", "version": "8537257874e949a59c834cecfd5a063e11b64b0b", "versionType": "git"}, {"lessThan": "611e839d2d552416b498ed5593e10670f61fcd4d", "status": "affected", "version": "8537257874e949a59c834cecfd5a063e11b64b0b", "versionType": "git"}, {"lessThan": "ba45e3d6b02c97dbb4578fbae7027fd66f3caa10", "status": "affected", "version": "8537257874e949a59c834cecfd5a063e11b64b0b", "versionType": "git"}, {"lessThan": "6c5124a60989051799037834f0a1a4b428718157", "status": "affected", "version": "8537257874e949a59c834cecfd5a063e11b64b0b", "versionType": "git"}, {"lessThan": "b1979778e98569c1e78c2c7f16bb24d76541ab00", "status": "affected", "version": "8537257874e949a59c834cecfd5a063e11b64b0b", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/can/usb/etas_es58x/es58x_core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.13"}, {"lessThan": "5.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.199", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.162", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.122", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.67", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "RUGGEDCOM RST2428P", "vendor": "Siemens", "versions": [{"lessThan": "V4.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: etas_es58x: allow partial RX URB allocation to succeed\n\nWhen es58x_alloc_rx_urbs() fails to allocate the requested number of\nURBs but succeeds in allocating some, it returns an error code.\nThis causes es58x_open() to return early, skipping the cleanup label\n'free_urbs', which leads to the anchored URBs being leaked.\n\nAs pointed out by maintainer Vincent Mailhol, the driver is designed\nto handle partial URB allocation gracefully. Therefore, partial\nallocation should not be treated as a fatal error.\n\nModify es58x_alloc_rx_urbs() to return 0 if at least one URB has been\nallocated, restoring the intended behavior and preventing the leak\nin es58x_open()."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncan: etas_es58x: permitir que la asignaci\u00f3n parcial de URB RX tenga \u00e9xito\n\nCuando es58x_alloc_rx_urbs() falla al asignar el n\u00famero solicitado de URBs pero logra asignar algunos, devuelve un c\u00f3digo de error. Esto hace que es58x_open() retorne prematuramente, salt\u00e1ndose la etiqueta de limpieza 'free_urbs', lo que lleva a la fuga de los URBs anclados.\n\nComo se\u00f1al\u00f3 el mantenedor Vincent Mailhol, el controlador est\u00e1 dise\u00f1ado para manejar la asignaci\u00f3n parcial de URB de manera elegante. Por lo tanto, la asignaci\u00f3n parcial no debe ser tratada como un error fatal.\n\nModificar es58x_alloc_rx_urbs() para que devuelva 0 si al menos un URB ha sido asignado, restaurando el comportamiento previsto y previniendo la fuga en es58x_open()."}], "id": "CVE-2026-23037", "lastModified": "2026-06-17T10:20:45.250", "metrics": {}, "published": "2026-01-31T12:16:07.010", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/611e839d2d552416b498ed5593e10670f61fcd4d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6c5124a60989051799037834f0a1a4b428718157"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/97250eb05e4b6afe787290e8fd97d0675116c61b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/aec888f44853584b5a7cd01249806030cf94a73d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b1979778e98569c1e78c2c7f16bb24d76541ab00"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ba45e3d6b02c97dbb4578fbae7027fd66f3caa10"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: can: etas_es58x: allow partial RX URB allocation to succeed", "id": "2435651", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2435651"}, "csaw": false, "details": ["In the Linux kernel, the following vulnerability has been resolved:\ncan: etas_es58x: allow partial RX URB allocation to succeed\nWhen es58x_alloc_rx_urbs() fails to allocate the requested number of\nURBs but succeeds in allocating some, it returns an error code.\nThis causes es58x_open() to return early, skipping the cleanup label\n'free_urbs', which leads to the anchored URBs being leaked.\nAs pointed out by maintainer Vincent Mailhol, the driver is designed\nto handle partial URB allocation gracefully. Therefore, partial\nallocation should not be treated as a fatal error.\nModify es58x_alloc_rx_urbs() to return 0 if at least one URB has been\nallocated, restoring the intended behavior and preventing the leak\nin es58x_open()."], "name": "CVE-2026-23037", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-01-31T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23037\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23037\nhttps://lore.kernel.org/linux-cve-announce/2026013122-CVE-2026-23037-6cae@gregkh/T"]}

{"analysis": {"en": {"generated_at": "2026-04-18T14:21:55.128012+00:00", "value": {"mitigation_remediation": ["Identify and apply the kernel patch that changes es58x_alloc_rx_urbs() to return success when at least one URB is allocated, preventing the leak.", "Rebuild and install the updated kernel, ensuring the etas_es58x driver is loaded from the new image.", "If a newer kernel release is available that includes the fix, upgrade the system to that kernel as an alternative to applying the patch."], "summary": {"action": "Apply patch", "impact": "Resource Leak/Denial of Service"}, "threat_synthesis": {"affected_systems": "Both Linux kernel variants that include the etas_es58x CAN driver are affected. No specific kernel version numbers are listed in the advisory, so all kernels containing the older implementation should be considered vulnerable until the patch is applied.", "description_and_impact": "The Linux kernel driver for the CAN device etas_es58x incorrectly treats partial allocation of USB Request Blocks (URBs) as a fatal error, allowing some URBs to remain allocated when the driver opens its interface. This results in a memory leak that can accumulate over time, potentially exhausting system resources and leading to a denial of service if the kernel runs out of memory for subsequent URB allocations.", "risk_and_exploitability": "The EPSS score of less than 1% indicates a very low probability of exploitation. No exploits are publicly known, and the vulnerability has not been listed in the CISA KEV catalog. Because the issue results in a resource leak that could grow over time, an attacker who can repeatedly trigger the driver\u2019s URB allocation path has the potential to exhaust kernel memory, leading to a denial of service. The severity is therefore primarily limited to systems that repeatedly use the etas_es58x driver or have high\u2011load USB environments."}}}}, "created": "2026-04-18T14:30:02.942982+00:00", "updated": "2026-04-18T14:30:02.942993+00:00", "vendors": [], "weaknesses": ["CWE-401"]}