CVE-2026-23058: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23058 is a memory leak vulnerability in the Linux kernel's ems_usb CAN bus driver, specifically in the ems_usb_read_bulk_callback() function. The flaw arises because USB Request Blocks (URBs) are unanchored by the USB framework before the completion callback is invoked, meaning completed in-URBs are never released when ems_usb_close() calls usb_kill_anchored_urbs(). The vulnerability affects Linux kernel versions from 2.6.32 up to the fixed releases: 6.6.122, 6.12.68, 6.18.8, and 6.19-rc7. No CVSS score has been formally assigned; the EPSS score is approximately 0.018% (Feedly, EUVD).

The root cause is a missing re-anchor operation for URBs in the USB bulk transfer completion callback (CWE-401: Missing Release of Memory after Effective Lifetime). In ems_usb_open(), URBs are allocated, anchored to dev->rx_submitted, and submitted. However, the USB subsystem automatically unanchors a URB before invoking its completion callback (ems_usb_read_bulk_callback()). When the callback resubmits the URB without re-anchoring it, the URB is no longer tracked by dev->rx_submitted, so the subsequent usb_kill_anchored_urbs() call in ems_usb_close() cannot free it. The fix mirrors the approach used in commit 7352e1d5932a for the gs_usb driver: explicitly re-anchoring the URB to dev->rx_submitted inside ems_usb_read_bulk_callback() before resubmission (Feedly, EUVD).

The primary impact is a kernel memory leak: each time a USB bulk transfer completes on an affected EMS CAN USB adapter, the associated URB is not freed, causing unbounded kernel memory consumption over time. Sustained operation of the affected device can lead to system resource exhaustion and potential denial of service (availability impact). There is no evidence of confidentiality or integrity impact, and the vulnerability does not enable privilege escalation or remote code execution (Feedly, EUVD).

No public proof-of-concept exploit code is known, and there is no evidence of in-the-wild exploitation. The vulnerability requires local access and physical or logical attachment of an EMS CAN USB device to trigger. The EPSS score is approximately 0.018%, reflecting very low exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

The Linux kernel project has released fixes in the following stable versions: 6.6.122, 6.12.68, 6.18.8, and 6.19-rc7. Patch commits are available at the upstream stable kernel repository. Distributions including Ubuntu (USN-8162-1, USN-8180-x series, USN-8275-1, USN-8278-x, USN-8289-x, USN-8296-x, USN-8297-1, USN-8393-1) and SUSE (SUSE-2026-0962-1) have issued updated kernel packages. Administrators should update to a patched kernel version as soon as possible; no configuration-based workaround is available other than avoiding use of EMS CAN USB adapters on unpatched systems (Ubuntu USN-8162-1, Ubuntu USN-8180-1, Linux Security SUSE).