CVE-2026-23061: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23061 is a memory leak vulnerability in the Linux kernel's kvaser_usb CAN bus USB driver, specifically in the kvaser_usb_read_bulk_callback() function. The flaw causes USB Request Blocks (URBs) to not be properly released after the USB framework unanchors them prior to callback completion, resulting in kernel memory that is never freed. It affects Linux kernel versions from 3.8 through multiple stable branches up to 6.19-rc6, with fixed versions available across all affected stable series. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium), with a local attack vector and high availability impact (Feedly).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). During device setup, URBs for USB-in transfers are allocated and added to the dev->rx_submitted anchor via kvaser_usb_setup_rx_urbs(). The USB framework automatically unanchors a URB before invoking its completion callback (kvaser_usb_read_bulk_callback()), meaning that once a URB completes, it is no longer tracked by the anchor. When the device is removed and usb_kill_anchored_urbs(&dev->rx_submitted) is called in kvaser_usb_remove_interfaces(), these completed-but-unanchored URBs are not freed, causing a persistent kernel memory leak. The fix re-anchors each URB back to dev->rx_submitted within the completion callback before resubmission, mirroring the approach taken in commit 7352e1d5932a for the gs_usb driver (Feedly, Kernel Patch).

Successful exploitation allows a local attacker with low privileges to gradually exhaust kernel memory by repeatedly triggering URB completion cycles — for example, through repeated connection and disconnection of Kvaser USB CAN adapters or by inducing error conditions that cause URB resubmission without proper cleanup. This can lead to system instability, application failures, and ultimately a complete system crash due to out-of-memory conditions. There is no confidentiality or integrity impact; the sole consequence is a high availability impact affecting the local system (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018%, reflecting a very low probability of exploitation in the near term. Exploitation requires local access and low privileges, and is further constrained by the need for a Kvaser USB CAN device to be present on the target system (Feedly).

• System Logs: Kernel messages (via dmesg or /var/log/kern.log) showing repeated URB allocation without corresponding deallocation for the kvaser_usb driver; warnings related to USB anchor or memory pressure.
• Memory: Gradual, unexplained depletion of kernel memory observable via /proc/meminfo (declining MemFree/MemAvailable) or tools like vmstat and free, particularly correlated with kvaser USB device activity.
• Process Behavior: Out-of-memory (OOM) killer events in system logs (oom-kill entries) not attributable to user-space processes, especially following repeated plug/unplug cycles of Kvaser USB CAN adapters.
• USB Events: Unusual frequency of USB device connect/disconnect events for Kvaser devices logged in udev or dmesg output.

Upgrade the Linux kernel to a patched stable version: 5.10.249 or later, 5.15.199 or later, 6.1.162 or later, 6.6.122 or later, 6.12.68 or later, or 6.18.8 or later. Patches are available through the Linux kernel stable git repository across multiple branches (Kernel Patch). For systems that cannot be immediately patched, restrict local user access to systems with Kvaser USB CAN devices, avoid repeated plug/unplug cycles of such adapters, and monitor kernel memory usage for unexpected depletion. Distribution-specific updates have been issued by Ubuntu (USN-8162-1, USN-8180-x series, USN-8186-1, USN-8188-1, USN-8275-1, USN-8278-x, USN-8289-x, USN-8296-x, USN-8297-1, USN-8393-1), SUSE, and Oracle Linux (Feedly).