CVE-2026-23082

can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error

published February 4, 2026

CVSS
—
EPSS
0%
Percentile
3.3
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error

In commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix

URB memory leak"), the URB was re-anchored before usb_submit_urb() in

gs_usb_receive_bulk_callback() to prevent a leak of this URB during

cleanup.

However, this patch did not take into account that usb_submit_urb() could

fail. The URB remains anchored and

usb_kill_anchored_urbs(&parent->rx_submitted) in gs_can_close() loops

infinitely since the anchor list never becomes empty.

To fix the bug, unanchor the URB when an usb_submit_urb() error occurs,

also print an info message.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00143 · 3.3th percentile
Published
2026-02-04T16:08Z
EPSS history
Timeline
  • 04 FEB 16:08Z
    can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error
    cvelistv5