CVE-2026-23075: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23075 is a memory leak vulnerability in the Linux kernel's esd_usb CAN bus USB driver, specifically in the esd_usb_read_bulk_callback() function. The flaw causes USB Request Blocks (URBs) to not be properly released when the driver is closed, leading to a denial-of-service condition via memory exhaustion. It affects Linux kernel versions from 2.6.36 through 6.19-rc6 across multiple stable branches. The vulnerability was published on February 4, 2026, with patches released on March 18, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In esd_usb_open(), URBs for USB-in transfers are allocated, anchored to dev->rx_submitted, and submitted. The USB framework automatically unanchors a URB before invoking its completion callback (esd_usb_read_bulk_callback()), meaning that once a URB completes, it is no longer tracked by the anchor. When esd_usb_close() calls usb_kill_anchored_urbs(&dev->rx_submitted) to free URBs, any completed-but-not-re-anchored URBs are skipped, resulting in a persistent memory leak. The fix re-anchors each URB back to dev->rx_submitted within the completion callback before resubmission, mirroring the approach taken in commit 7352e1d5932a for the gs_usb driver (Feedly, Kernel Patch).

A local user with low privileges can repeatedly trigger the vulnerable code path by opening and using an esd_usb CAN interface, causing URB memory allocations to accumulate without being freed. Over time, this exhausts kernel memory, potentially leading to system slowdowns, application failures, or a full system crash. The impact is limited to availability (denial of service); there is no confidentiality or integrity impact (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The vulnerability requires local access with low privileges and low attack complexity, with no user interaction needed. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

Update to a patched Linux kernel version as soon as possible. Fixed versions by branch are: 5.10.249 (for 5.10.x), 5.15.199 (for 5.15.x), 6.1.162 (for 6.1.x), 6.6.122 (for 6.6.x), 6.12.68 (for 6.12.x), and 6.18.8 (for 6.18.x). Patches are available at the kernel.org stable repository (commit hashes: 5a4391b, 92d26ce, 93b34d4, 9d1807b, a9503ae, adec5e1, dc934d9). If immediate patching is not feasible, consider disabling the esd_usb kernel module (modprobe -r esd_usb) on systems where esd_usb CAN hardware is not in use, and monitor for signs of memory pressure (Feedly, Kernel Patch).

Ubuntu issued multiple security notices addressing this vulnerability, including USN-8162-1, USN-8180-1 through USN-8180-6, USN-8186-1, USN-8188-1, USN-8275-1, USN-8278-1, USN-8289-1, USN-8296-1, USN-8297-1, and USN-8393-1, reflecting broad distribution-level patching activity (Ubuntu USN-8180-1, Ubuntu USN-8162-1). The Yocto Project security mailing list also flagged the issue for embedded Linux users (Yocto Security). No notable independent researcher commentary or social media discussion has been identified.