CVE-2026-23037: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23037 is a resource leak vulnerability in the Linux kernel's CAN ETAS ES58X USB driver (can: etas_es58x). When es58x_alloc_rx_urbs() partially succeeds in allocating USB Request Blocks (URBs) but returns an error code, es58x_open() exits early and skips the free_urbs cleanup label, causing the allocated URBs to be permanently leaked. The vulnerability was published on January 31, 2026, and affects Linux kernel versions from the introduction of the driver (commit 8537257874e9) up to the patched releases. The CVSS score has not been formally assigned (estimated Medium severity by Feedly) (Red Hat Bugzilla, Feedly).

The root cause is improper resource cleanup (CWE-401: Missing Release of Memory after Effective Lifetime) in the es58x_alloc_rx_urbs() function within the Linux kernel's drivers/net/can/usb/etas_es58x/ subsystem. When the function allocates at least one URB but fewer than the requested number, it incorrectly returns a non-zero error code; this causes the caller es58x_open() to return early, bypassing the free_urbs cleanup path and leaving the anchored URBs unreleased. The fix modifies es58x_alloc_rx_urbs() to return 0 (success) whenever at least one URB has been successfully allocated, restoring the driver's intended graceful partial-allocation behavior (Red Hat Bugzilla, Feedly).

Repeated triggering of partial URB allocation failures during CAN device initialization — whether through malfunctioning hardware, resource pressure, or deliberate action by a local user with device access — can progressively exhaust kernel memory. This may lead to system instability, degraded performance, or a denial-of-service condition requiring a system restart. The vulnerability is confined to systems with ETAS ES58X CAN-USB adapters attached and does not directly expose confidential data or allow privilege escalation (Feedly).

Apply the available kernel patches that fix es58x_alloc_rx_urbs(). Patched versions include Linux 6.6.122, 6.12.67, 6.18.7, and 6.19-rc6 (and later). Downstream distributions have issued their own advisories: Ubuntu has released fixes in USN-8162-1, USN-8180-1/2/4/5/6, USN-8186-1, USN-8188-1, USN-8275-1, USN-8278-1/2, USN-8289-1/2, USN-8296-1/2, USN-8297-1, and USN-8393-1; SUSE has addressed it in SUSE-2026-0962-1. As a temporary workaround, avoid attaching ETAS ES58X CAN-USB devices on systems where kernel memory is constrained, and minimize unnecessary device open/close cycles until patching is complete (Feedly, Red Hat Bugzilla, Ubuntu USN-8162-1).