CVE-2026-23108

A memory leak vulnerability was found in the Linux kernel's USB 8devices CAN adapter driver. The URBs allocated for USB-in transfers are unanchored by the USB framework before the completion callback is invoked. Since usb_8dev_read_bulk_callback() does not re-anchor the URBs, they are never freed when usb_kill_anchored_urbs() is called during device close, causing a memory leak on each open/close cycle.

This is primarily a resource management bug. Consider operational risk higher on systems with frequent connect disconnect or high CAN traffic because leaks accumulate over time.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the usb_8dev module from being loaded if USB 8devices CAN adapters are not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.