CVE-2026-23347

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23347", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.999Z", "datePublished": "2026-03-25T10:27:33.753Z", "dateUpdated": "2026-05-11T22:05:06.123Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:05:06.123Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: usb: f81604: correctly anchor the urb in the read bulk callback\n\nWhen submitting an urb, that is using the anchor pattern, it needs to be\nanchored before submitting it otherwise it could be leaked if\nusb_kill_anchored_urbs() is called. This logic is correctly done\nelsewhere in the driver, except in the read bulk callback so do that\nhere also."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/can/usb/f81604.c"], "versions": [{"version": "88da17436973e463bed59bea79771fb03a21555e", "lessThan": "54ee74307165b348b2fddcd7942eb48fb4ee1237", "status": "affected", "versionType": "git"}, {"version": "88da17436973e463bed59bea79771fb03a21555e", "lessThan": "c001214e12202338425d6dda5d2a1919d674282d", "status": "affected", "versionType": "git"}, {"version": "88da17436973e463bed59bea79771fb03a21555e", "lessThan": "f6d80b104f904a6da922907394eec66d3e2ffc57", "status": "affected", "versionType": "git"}, {"version": "88da17436973e463bed59bea79771fb03a21555e", "lessThan": "7724645c4792914cd07f36718816c5369cc57970", "status": "affected", "versionType": "git"}, {"version": "88da17436973e463bed59bea79771fb03a21555e", "lessThan": "952caa5da10bed22be09612433964f6877ba0dde", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/can/usb/f81604.c"], "versions": [{"version": "6.5", "status": "affected"}, {"version": "0", "lessThan": "6.5", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.130", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.77", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.17", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.7", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.6.130"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.12.77"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.18.17"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.19.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/54ee74307165b348b2fddcd7942eb48fb4ee1237"}, {"url": "https://git.kernel.org/stable/c/c001214e12202338425d6dda5d2a1919d674282d"}, {"url": "https://git.kernel.org/stable/c/f6d80b104f904a6da922907394eec66d3e2ffc57"}, {"url": "https://git.kernel.org/stable/c/7724645c4792914cd07f36718816c5369cc57970"}, {"url": "https://git.kernel.org/stable/c/952caa5da10bed22be09612433964f6877ba0dde"}], "title": "can: usb: f81604: correctly anchor the urb in the read bulk callback", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/can/usb/f81604.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "54ee74307165b348b2fddcd7942eb48fb4ee1237", "status": "affected", "version": "88da17436973e463bed59bea79771fb03a21555e", "versionType": "git"}, {"lessThan": "c001214e12202338425d6dda5d2a1919d674282d", "status": "affected", "version": "88da17436973e463bed59bea79771fb03a21555e", "versionType": "git"}, {"lessThan": "f6d80b104f904a6da922907394eec66d3e2ffc57", "status": "affected", "version": "88da17436973e463bed59bea79771fb03a21555e", "versionType": "git"}, {"lessThan": "7724645c4792914cd07f36718816c5369cc57970", "status": "affected", "version": "88da17436973e463bed59bea79771fb03a21555e", "versionType": "git"}, {"lessThan": "952caa5da10bed22be09612433964f6877ba0dde", "status": "affected", "version": "88da17436973e463bed59bea79771fb03a21555e", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/can/usb/f81604.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.5"}, {"lessThan": "6.5", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.130", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.77", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.17", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "32772849-BF02-4208-99C1-068667D43F23", "versionEndExcluding": "6.6.130", "versionStartIncluding": "6.5.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B3D12E00-E42D-4056-B354-BAD4903C03A5", "versionEndExcluding": "6.12.77", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A5E006E4-59C7-43C1-9231-62A72219F2BA", "versionEndExcluding": "6.18.17", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "69245D10-0B71-485E-80C3-A64F077004D3", "versionEndExcluding": "6.19.7", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.5:-:*:*:*:*:*:*", "matchCriteriaId": "A2D9420A-9BF4-4C16-B6DA-8A1D279F7384", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: usb: f81604: correctly anchor the urb in the read bulk callback\n\nWhen submitting an urb, that is using the anchor pattern, it needs to be\nanchored before submitting it otherwise it could be leaked if\nusb_kill_anchored_urbs() is called. This logic is correctly done\nelsewhere in the driver, except in the read bulk callback so do that\nhere also."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncan: usb: f81604: anclar correctamente el urb en la devoluci\u00f3n de llamada de lectura masiva\n\nAl enviar un urb, que est\u00e1 usando el patr\u00f3n de anclaje, necesita ser anclado antes de enviarlo, de lo contrario, podr\u00eda filtrarse si se llama a usb_kill_anchored_urbs(). Esta l\u00f3gica se realiza correctamente en otras partes del controlador, excepto en la devoluci\u00f3n de llamada de lectura masiva, as\u00ed que hazlo aqu\u00ed tambi\u00e9n."}], "id": "CVE-2026-23347", "lastModified": "2026-06-17T10:21:24.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-03-25T11:16:32.903", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/54ee74307165b348b2fddcd7942eb48fb4ee1237"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7724645c4792914cd07f36718816c5369cc57970"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/952caa5da10bed22be09612433964f6877ba0dde"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c001214e12202338425d6dda5d2a1919d674282d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f6d80b104f904a6da922907394eec66d3e2ffc57"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: can: usb: f81604: correctly anchor the urb in the read bulk callback", "id": "2451173", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451173"}, "csaw": false, "cwe": "CWE-771", "details": ["A flaw was found in the Linux kernel's `can: usb: f81604` driver. When a USB Request Block (urb) is submitted, it is not correctly anchored in the read bulk callback. This oversight could lead to a resource leak if `usb_kill_anchored_urbs()` is called, potentially resulting in a Denial of Service (DoS) due to resource exhaustion."], "name": "CVE-2026-23347", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-03-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23347\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23347\nhttps://lore.kernel.org/linux-cve-announce/2026032536-CVE-2026-23347-fa08@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[88da17436973e463bed59bea79771fb03a21555e,54ee74307165b348b2fddcd7942eb48fb4ee1237)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[88da17436973e463bed59bea79771fb03a21555e,c001214e12202338425d6dda5d2a1919d674282d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[88da17436973e463bed59bea79771fb03a21555e,f6d80b104f904a6da922907394eec66d3e2ffc57)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[88da17436973e463bed59bea79771fb03a21555e,7724645c4792914cd07f36718816c5369cc57970)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[88da17436973e463bed59bea79771fb03a21555e,952caa5da10bed22be09612433964f6877ba0dde)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.5"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.5)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.130,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.77,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.17,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.7,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-29T00:40:45.569630+00:00", "value": {"mitigation_remediation": ["Upgrade the kernel to a version that contains the f81604 URB anchoring fix for CVE\u20112026\u201123347.", "If a vendor update is not yet available, rebuild and install a custom kernel with the patched f81604 driver.", "Disable or restrict USB device usage by applying device filtering rules or disabling unused USB ports to reduce exposure to the flaw."], "summary": {"action": "Apply Patch", "impact": "Reference Counting Leak"}, "threat_synthesis": {"affected_systems": "All Linux kernel builds that include the f81604 driver and have not yet received the patch are affected. The advisory lists no specific kernel versions, so any kernel containing the driver is potentially vulnerable until the update is applied.", "description_and_impact": "The Linux kernel driver for the f81604 USB controller contains a flaw where USB Request Blocks (URBs) that use the anchor pattern are not anchored before submission within the read bulk callback. Because the URB is not anchored, when the kernel function usb_kill_anchored_urbs() is called the URB may remain referenced and leak kernel memory or kernel data structures. This is a reference\u2011counting error (CWE\u2011771) that could expose sensitive kernel information but does not enable arbitrary code execution or memory corruption directly.", "risk_and_exploitability": "The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1\u202f% combined with the absence from CISA\u2019s KEV catalog suggest a low likelihood of exploitation. The vulnerability requires a USB device that engages the f81604 controller and triggers a read bulk operation; the likely attack vector is a local or physical access scenario, inferred from the fact that the flaw is triggered by USB activity on the target system. While the risk to confidentiality is limited to leaked kernel references, patching is advised to eliminate the reference\u2011counting issue."}}}}, "created": "2026-03-25T21:32:07.769064+00:00", "title": "Unanchored URB Reference Leak in Linux f81604 USB Driver", "updated": "2026-04-29T00:45:26.163890+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}