CVE-2026-23080: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23080 is a memory leak vulnerability in the Linux kernel's MCBA USB CAN bus driver (mcba_usb), specifically in the mcba_usb_read_bulk_callback() function. The flaw arises because the USB framework unanchors URBs (USB Request Blocks) before invoking the completion callback, causing completed in-URBs to escape the priv->rx_submitted anchor and never be freed by usb_kill_anchored_urbs() during device closure. It affects Linux kernel versions from 4.12 through multiple stable branches, with fixed versions including 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.68, and 6.18.8. The vulnerability was published on February 4, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, kernel patches).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In mcba_usb_probe() → mcba_usb_start(), URBs for USB bulk-in transfers are allocated, anchored to priv->rx_submitted, and submitted. Upon completion, mcba_usb_read_bulk_callback() processes and resubmits the URBs, but the USB framework automatically unanchors each URB before calling the completion handler. This means the resubmitted URB is no longer tracked by the anchor, so when mcba_usb_close() calls usb_kill_anchored_urbs(&priv->rx_submitted), the completed URBs are not released, causing a kernel memory leak. The fix re-anchors the URB inside mcba_usb_read_bulk_callback() before resubmission, mirroring the approach taken in commit 7352e1d5932a for the gs_usb driver (Feedly, kernel patches).

A local attacker with low privileges can trigger a denial of service by repeatedly cycling MCBA USB CAN device probe and close operations, causing unreleased URB memory to accumulate in kernel space. Over time, this memory exhaustion can lead to system instability, performance degradation, or a complete denial of service. There is no confidentiality or integrity impact; the vulnerability is limited to availability (HIGH) with no risk of data exposure or lateral movement (Feedly).

Apply the available kernel patches to upgrade to a fixed version: 5.10.249+ (for 4.12–5.10.248), 5.15.199+ (for 5.11–5.15.198), 6.1.162+ (for 5.16–6.1.161), 6.6.122+ (for 6.2–6.6.121), 6.12.68+ (for 6.7–6.12.67), or 6.18.8+ (for 6.13–6.18.7). Patch commits are available at git.kernel.org (e.g., 179f6f0cf5ae, 59153b6388e0, 710a7529fb13, 8b34c611a4fe, 94c9f6f7b953, b5a1ccdc63b7, d374d715e338). As an interim workaround, restrict unprivileged user access to USB device operations or disable/remove the mcba_usb kernel module if MCBA USB CAN devices are not required. Ubuntu security notices USN-8162-1, USN-8180-1 through USN-8180-6, USN-8186-1, USN-8188-1, USN-8275-1, USN-8278-1/2, USN-8289-1/2, USN-8296-1/2, USN-8297-1, and SUSE advisory SUSE-2026-0962-1 address this issue (Ubuntu USN-8180-1, SUSE Advisory, kernel patches).