CVE-2026-23082: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23082 is a denial-of-service vulnerability in the Linux kernel's CAN USB (gs_usb) driver, caused by an infinite loop triggered when usb_submit_urb() fails during bulk receive callback processing. The flaw was introduced as a side effect of commit 7352e1d5932a, which fixed a URB memory leak by re-anchoring the URB before submission but did not account for submission failures. Affected kernel versions include 6.12.67, 6.18.7, and 6.19-rc6. It was published on February 4, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, CVE Record).

The root cause is classified as CWE-835 (Loop with Unreachable Exit Condition / Infinite Loop). In gs_usb_receive_bulk_callback(), a URB is re-anchored to the rx_submitted anchor list prior to calling usb_submit_urb(). If usb_submit_urb() returns an error, the URB remains anchored but is never submitted or freed. When gs_can_close() subsequently calls usb_kill_anchored_urbs(&parent->rx_submitted), it loops infinitely because the anchor list never becomes empty. The fix unanchors the URB upon usb_submit_urb() failure and emits an informational log message. Exploitation requires local access with low privileges and no user interaction (Feedly).

Successful exploitation causes a denial-of-service condition where the system becomes unresponsive and unable to properly close CAN USB devices. The infinite loop in gs_can_close() effectively hangs the kernel thread handling CAN device teardown, impacting availability with no confidentiality or integrity consequences. The scope is limited to the local system and specifically to CAN USB device operations (Feedly).

• Logs: Kernel log messages indicating repeated or stalled calls related to gs_can_close() or usb_kill_anchored_urbs(); absence of expected usb_submit_urb() success messages in the CAN USB driver context.
• Process/System Behavior: System unresponsiveness or hang when attempting to close or disconnect a CAN USB (gs_usb) device; kernel threads stuck in an uninterruptible wait state (D state in process listings) associated with CAN USB device teardown.
• Kernel: Kernel oops or soft lockup warnings referencing gs_usb_receive_bulk_callback or gs_can_close in dmesg output.

Update the Linux kernel to a patched version: 6.12.68 or later, 6.18.8 or later, or 6.19-rc7 or later, depending on the active kernel branch. Patches are available via multiple upstream commits: 79a6d1bfe114, aa8a8866c533, c3edc14da81a, c610b550ccc0, and ce4352057fc5 (Kernel Patches). If immediate patching is not feasible, restrict local user access to CAN USB devices and disable CAN USB functionality if not operationally required. SUSE and Oracle Linux have also issued distribution-specific kernel updates addressing this vulnerability (Linux Security SUSE, Linux Security Oracle).