CVE-2026-23082

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23082", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.960Z", "datePublished": "2026-02-04T16:08:06.731Z", "dateUpdated": "2026-05-11T21:59:39.102Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T21:59:39.102Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error\n\nIn commit 7352e1d5932a (\"can: gs_usb: gs_usb_receive_bulk_callback(): fix\nURB memory leak\"), the URB was re-anchored before usb_submit_urb() in\ngs_usb_receive_bulk_callback() to prevent a leak of this URB during\ncleanup.\n\nHowever, this patch did not take into account that usb_submit_urb() could\nfail. The URB remains anchored and\nusb_kill_anchored_urbs(&parent->rx_submitted) in gs_can_close() loops\ninfinitely since the anchor list never becomes empty.\n\nTo fix the bug, unanchor the URB when an usb_submit_urb() error occurs,\nalso print an info message."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/can/usb/gs_usb.c"], "versions": [{"version": "9c151898cc259a7784be60ba38664f42ede39b31", "lessThan": "da01de754e455e2598a7f1ce4ff2078c4f0ecde1", "status": "affected", "versionType": "git"}, {"version": "ec5ccc2af9e5b045671f3f604b57512feda8bcc5", "lessThan": "aa8a8866c533a150be4763bcb27993603bd5426c", "status": "affected", "versionType": "git"}, {"version": "f905bcfa971edb89e398c98957838d8c6381c0c7", "lessThan": "ce4352057fc5a986c76ece90801b9755e7c6e56c", "status": "affected", "versionType": "git"}, {"version": "08624b7206ddb9148eeffc2384ebda2c47b6d1e9", "lessThan": "c610b550ccc0438d456dfe1df9f4f36254ccaae3", "status": "affected", "versionType": "git"}, {"version": "9f669a38ca70839229b7ba0f851820850a2fe1f7", "lessThan": "c3edc14da81a8d8398682f6e4ab819f09f37c0b7", "status": "affected", "versionType": "git"}, {"version": "7352e1d5932a0e777e39fa4b619801191f57e603", "lessThan": "79a6d1bfe1148bc921b8d7f3371a7fbce44e30f7", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/can/usb/gs_usb.c"], "versions": [{"version": "6.12.67", "lessThan": "6.12.68", "status": "affected", "versionType": "semver"}, {"version": "6.18.7", "lessThan": "6.18.8", "status": "affected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.67", "versionEndExcluding": "6.12.68"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.7", "versionEndExcluding": "6.18.8"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/da01de754e455e2598a7f1ce4ff2078c4f0ecde1"}, {"url": "https://git.kernel.org/stable/c/aa8a8866c533a150be4763bcb27993603bd5426c"}, {"url": "https://git.kernel.org/stable/c/ce4352057fc5a986c76ece90801b9755e7c6e56c"}, {"url": "https://git.kernel.org/stable/c/c610b550ccc0438d456dfe1df9f4f36254ccaae3"}, {"url": "https://git.kernel.org/stable/c/c3edc14da81a8d8398682f6e4ab819f09f37c0b7"}, {"url": "https://git.kernel.org/stable/c/79a6d1bfe1148bc921b8d7f3371a7fbce44e30f7"}], "title": "can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/can/usb/gs_usb.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "da01de754e455e2598a7f1ce4ff2078c4f0ecde1", "status": "affected", "version": "9c151898cc259a7784be60ba38664f42ede39b31", "versionType": "git"}, {"lessThan": "aa8a8866c533a150be4763bcb27993603bd5426c", "status": "affected", "version": "ec5ccc2af9e5b045671f3f604b57512feda8bcc5", "versionType": "git"}, {"lessThan": "ce4352057fc5a986c76ece90801b9755e7c6e56c", "status": "affected", "version": "f905bcfa971edb89e398c98957838d8c6381c0c7", "versionType": "git"}, {"lessThan": "c610b550ccc0438d456dfe1df9f4f36254ccaae3", "status": "affected", "version": "08624b7206ddb9148eeffc2384ebda2c47b6d1e9", "versionType": "git"}, {"lessThan": "c3edc14da81a8d8398682f6e4ab819f09f37c0b7", "status": "affected", "version": "9f669a38ca70839229b7ba0f851820850a2fe1f7", "versionType": "git"}, {"lessThan": "79a6d1bfe1148bc921b8d7f3371a7fbce44e30f7", "status": "affected", "version": "7352e1d5932a0e777e39fa4b619801191f57e603", "versionType": "git"}]}, {"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/can/usb/gs_usb.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6.12.68", "status": "affected", "version": "6.12.67", "versionType": "semver"}, {"lessThan": "6.18.8", "status": "affected", "version": "6.18.7", "versionType": "semver"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:6.12.67:*:*:*:*:*:*:*", "matchCriteriaId": "59F27AC7-EC6E-439C-A4DE-3E0179CDFE1D", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.18.7:*:*:*:*:*:*:*", "matchCriteriaId": "20B6C380-0FF3-4ECC-AA45-F055A5ECBFA1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*", "matchCriteriaId": "3EF854A1-ABB1-4E93-BE9A-44569EC76C0D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error\n\nIn commit 7352e1d5932a (\"can: gs_usb: gs_usb_receive_bulk_callback(): fix\nURB memory leak\"), the URB was re-anchored before usb_submit_urb() in\ngs_usb_receive_bulk_callback() to prevent a leak of this URB during\ncleanup.\n\nHowever, this patch did not take into account that usb_submit_urb() could\nfail. The URB remains anchored and\nusb_kill_anchored_urbs(&parent->rx_submitted) in gs_can_close() loops\ninfinitely since the anchor list never becomes empty.\n\nTo fix the bug, unanchor the URB when an usb_submit_urb() error occurs,\nalso print an info message."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncan: gs_usb: gs_usb_receive_bulk_callback(): desanclar URL en error de usb_submit_urb()\n\nEn el commit 7352e1d5932a (\"can: gs_usb: gs_usb_receive_bulk_callback(): corregir fuga de memoria de URB\"), el URB fue re-anclado antes de usb_submit_urb() en gs_usb_receive_bulk_callback() para prevenir una fuga de este URB durante la limpieza.\n\nSin embargo, este parche no tuvo en cuenta que usb_submit_urb() podr\u00eda fallar. El URB permanece anclado y usb_kill_anchored_urbs(&parent->rx_submitted) en gs_can_close() entra en un bucle infinito ya que la lista de anclajes nunca queda vac\u00eda.\n\nPara corregir el error, desanclar el URB cuando ocurre un error de usb_submit_urb(), tambi\u00e9n imprimir un mensaje de informaci\u00f3n."}], "id": "CVE-2026-23082", "lastModified": "2026-06-17T10:20:50.033", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-02-04T17:16:19.060", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/79a6d1bfe1148bc921b8d7f3371a7fbce44e30f7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/aa8a8866c533a150be4763bcb27993603bd5426c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c3edc14da81a8d8398682f6e4ab819f09f37c0b7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c610b550ccc0438d456dfe1df9f4f36254ccaae3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ce4352057fc5a986c76ece90801b9755e7c6e56c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/da01de754e455e2598a7f1ce4ff2078c4f0ecde1"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-835"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error", "id": "2436754", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436754"}, "csaw": false, "details": ["No description is available for this CVE."], "name": "CVE-2026-23082", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-02-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23082\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23082\nhttps://lore.kernel.org/linux-cve-announce/2026020422-CVE-2026-23082-7bc8@gregkh/T"]}

{"analysis": {"en": {"generated_at": "2026-04-17T23:36:54.675088+00:00", "value": {"mitigation_remediation": ["Update the Linux kernel to a release that includes the fix for gs_usb_receive_bulk_callback() (e.g., a kernel newer than 6.12.67 that incorporates commit 7352e1d5932a).", "If an immediate kernel upgrade is not possible, disable the gs_usb CAN USB driver or unload the CAN subsystem modules to prevent the fault from being triggered.", "Reboot the system after applying the patch or after disabling the driver to clear any existing anchored URBs and restore normal operation."], "summary": {"action": "Apply Patch", "impact": "Denial of Service via infinite loop in the CAN bus USB driver"}, "threat_synthesis": {"affected_systems": "Affected systems are Linux kernel users with the gs_usb driver, specifically kernel releases 6.12.67, 6.18.7, and 6.19\u202frc6, as well as any kernel built from the same source that includes the same driver code.", "description_and_impact": "The vulnerability arises when the GS USB driver attempts to submit a USB Request Block (URB) and the operation fails. The code fails to unanchor the URB, so the kernel\u2019s anchored list never becomes empty. During driver cleanup, usb_kill_anchored_urbs() enters an infinite loop, consuming CPU and preventing the driver from releasing resources. This flaw can result in a service interruption or kernel lock\u2011up in systems that use the CAN bus subsystem.", "risk_and_exploitability": "The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The flaw is not listed in CISA\u2019s KEV catalog. An attacker would need to interact with the CAN USB subsystem, likely with kernel\u2011level privileges or via an application that triggers the driver\u2019s cleanup, such as closing a device file. While no public exploit is known, the infinite loop could be triggered by malformed or failed CAN USB requests, making it a viable denial\u2011of\u2011service vector in environments where the CAN bus is used."}}}}, "created": "2026-04-17T23:45:25.810265+00:00", "updated": "2026-04-17T23:45:25.810275+00:00", "vendors": []}