CVE-2026-23058

A flaw was found in the Linux kernel's ems_usb Controller Area Network (CAN) Universal Serial Bus (USB) driver. A local user with access to the CAN network interface can repeatedly trigger open and close cycles, leading to a memory leak. This occurs because completed USB Request Blocks (URBs) are unanchored by the USB core before the completion callback runs, preventing proper cleanup. Over time, this resource exhaustion can lead to a denial of service.

A memory leak can occur in the ems_usb CAN USB driver because completed RX URBs are unanchored by the USB core before the completion callback runs. The driver anchored URBs only during open and then relied on usb_kill_anchored_urbs during close to free them. Once an URB completes it is no longer in the rx_submitted anchor and it can escape cleanup which leads to leaked URB allocations over repeated activity and open close cycles. For the CVSS the PR is L in the paranoid rating because a user with access to the CAN network interface can often trigger open close or device use through standard networking administration in delegated environments. The issue is not directly network reachable in the IP sense. Impact is denial of service via resource exhaustion over time.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.