CVE-2026-23075: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23075 is a memory leak vulnerability in the Linux kernel's esd_usb CAN bus USB driver, specifically in the esd_usb_read_bulk_callback() function. The flaw causes USB Request Blocks (URBs) to not be properly released when the driver is closed, leading to a denial-of-service condition via memory exhaustion. It affects Linux kernel versions from 2.6.36 through 6.19-rc6 across multiple stable branches. The vulnerability was published on February 4, 2026, with patches released on March 18, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In esd_usb_open(), URBs for USB-in transfers are allocated, anchored to dev->rx_submitted, and submitted. The USB framework automatically unanchors a URB before invoking its completion callback (esd_usb_read_bulk_callback()), meaning that once a URB completes, it is no longer tracked by the anchor. When esd_usb_close() calls usb_kill_anchored_urbs(&dev->rx_submitted) to free URBs, any completed-but-not-re-anchored URBs are skipped, resulting in a persistent memory leak. The fix re-anchors each URB back to dev->rx_submitted within the completion callback before resubmission, mirroring the approach taken in commit 7352e1d5932a for the gs_usb driver (Feedly, Kernel Patch).

A local user with low privileges can repeatedly trigger the vulnerable code path by opening and using an esd_usb CAN interface, causing URB memory allocations to accumulate without being freed. Over time, this exhausts kernel memory, potentially leading to system slowdowns, application failures, or a full system crash. The impact is limited to availability (denial of service); there is no confidentiality or integrity impact (Feedly).

Update to a patched Linux kernel version as soon as possible. Fixed versions by branch are: 5.10.249 (for 5.10.x), 5.15.199 (for 5.15.x), 6.1.162 (for 6.1.x), 6.6.122 (for 6.6.x), 6.12.68 (for 6.12.x), and 6.18.8 (for 6.18.x). Patches are available at the kernel.org stable repository (commit hashes: 5a4391b, 92d26ce, 93b34d4, 9d1807b, a9503ae, adec5e1, dc934d9). If immediate patching is not feasible, consider disabling the esd_usb kernel module (modprobe -r esd_usb) on systems where esd_usb CAN hardware is not in use, and monitor for signs of memory pressure (Feedly, Kernel Patch).

Ubuntu issued multiple security notices addressing this vulnerability, including USN-8162-1, USN-8180-1 through USN-8180-6, USN-8186-1, USN-8188-1, USN-8275-1, USN-8278-1, USN-8289-1, USN-8296-1, USN-8297-1, and USN-8393-1, reflecting broad distribution-level patching activity (Ubuntu USN-8180-1, Ubuntu USN-8162-1). The Yocto Project security mailing list also flagged the issue for embedded Linux users (Yocto Security). No notable independent researcher commentary or social media discussion has been identified.