CVE-2026-23031: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23031 is a memory leak vulnerability in the Linux kernel's CAN USB driver (gs_usb) within the gs_usb_receive_bulk_callback() function. The flaw arises because the USB framework unanchors a URB (USB Request Block) before invoking the completion callback, causing completed in-transfer URBs to escape the parent->rx_submitted anchor and never be freed when gs_can_close() is called. It affects Linux kernel versions from the introduction of the gs_usb driver (commit d08e973a77d1) up to the patched releases. Published on January 31, 2026, it carries a CVSS v3.1 base score of 7.0 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper resource management (CWE-401: Missing Release of Memory after Effective Lifetime) in the gs_usb CAN-over-USB kernel driver. In gs_can_open(), URBs are allocated, anchored to parent->rx_submitted, and submitted; however, the USB core framework automatically unanchors a URB before calling its completion callback (gs_usb_receive_bulk_callback()). As a result, each completed URB is no longer tracked by the anchor, so the cleanup call usb_kill_anchored_urbs(parent->rx_submitted) in gs_can_close() fails to release them, producing a persistent memory leak. The fix re-anchors the URB to parent->rx_submitted inside gs_usb_receive_bulk_callback() before resubmission, ensuring proper lifecycle tracking. Exploitation requires local access with low privileges and high attack complexity (Red Hat Bugzilla, Feedly).

Successful exploitation allows a local attacker with low privileges to cause a denial-of-service condition through gradual memory exhaustion on systems actively using CAN USB devices. Repeated opening and closing of the CAN interface (or sustained USB traffic) progressively consumes kernel memory, potentially leading to system instability, kernel panics, or crashes. Confidentiality and integrity impacts are also rated High in the CVSS assessment, though the primary practical risk is availability loss (Red Hat Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of writing (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. Exploitation is constrained by the requirement for local access, low privileges, and high attack complexity, limiting the practical attacker pool to users with physical or shell access to systems running CAN USB hardware.

• System Logs: Kernel messages (via dmesg or /var/log/kern.log) showing repeated allocation of USB URBs without corresponding frees; warnings related to gs_usb or usb_submit_urb failures under memory pressure.
• Memory Monitoring: Sustained, unexplained growth in kernel memory usage (/proc/meminfo showing decreasing MemFree/MemAvailable) correlated with CAN USB device activity; tools like slabtop showing abnormal growth in USB-related slab caches.
• Process/Device Behavior: Repeated open/close cycles on CAN network interfaces (e.g., can0, can1) by unprivileged processes; unexpected system slowdowns or OOM (Out-of-Memory) killer events on systems with CAN USB adapters attached.

Apply the upstream kernel patches corresponding to commits f905bcfa971edb89e398c98957838d8c6381c0c7, 08624b7206ddb9148eeffc2384ebda2c47b6d1e9, 9f669a38ca70839229b7ba0f851820850a2fe1f7, and 7352e1d5932a0e777e39fa4b619801191f57e603. Patched stable kernel versions include 6.6.122, 6.12.67, 6.18.7, and 6.19-rc6 or later. Downstream distributions including Ubuntu (USN-8278-1, USN-8289-1, USN-8296-1, USN-8278-2, USN-8296-2, USN-8289-2) and Oracle Enterprise Linux have released updated packages. As a workaround where patching is not immediately possible, restrict access to CAN USB devices to trusted users only and monitor kernel memory usage for signs of leakage (Red Hat Bugzilla, Feedly).