CVE-2026-74459

A flaw was found in the Linux kernel's can: etas_es58x module. A memory leak occurs in the es58x_read_bulk_callback() function when an Urban Request Block (URB) resubmission fails. This failure prevents the proper release of the associated receive (RX) buffer, leading to a gradual exhaustion of system memory. This can ultimately result in a denial of service (DoS) for affected systems.

A moderate-impact flaw was found in the Linux kernel's ETAS ES58X USB CAN controller driver. In es58x_read_bulk_callback(), when the resubmission of the receive USB request block (URB) fails, the error path unanchors the URB and returns directly, skipping the driver's existing cleanup path, so the coherent transfer buffer allocated with usb_alloc_coherent() is never released. A local attacker with access to a system that has an ES58X USB CAN device attached, and who can cause repeated RX URB resubmission failures, could leak kernel memory, which over time can exhaust system memory and result in a denial of service. The flaw affects only availability (no impact on confidentiality or integrity) and requires local access. All Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel streams are not affected by this issue because the vulnerable code is not present in the shipped kernel packages, so no Red Hat products are currently exposed to this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.