CVE-2026-23108: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23108 is a memory leak vulnerability in the Linux kernel's usb_8dev CAN-over-USB driver, specifically in the usb_8dev_read_bulk_callback() function. The flaw affects Linux kernel versions from 3.9 up to (but not including) 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.68, and 6.18.8, as well as pre-release 6.19-rc1 through 6.19-rc6. It was published on February 4, 2026, with patches added on March 18, 2026. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium), requiring local access with low privileges (Feedly).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In usb_8dev_open() → usb_8dev_start(), USB Request Blocks (URBs) for USB-in transfers are allocated, anchored to priv->rx_submitted, and submitted. The USB framework automatically unanchors a URB before invoking its completion callback (usb_8dev_read_bulk_callback()), meaning that once a URB completes, it is no longer tracked by the anchor. When the device is closed via usb_8dev_close() → unlink_all_urbs(), the call to usb_kill_anchored_urbs(&priv->rx_submitted) fails to free these already-unanchored URBs, resulting in a kernel memory leak. The fix re-anchors the URB back to priv->rx_submitted inside the completion callback before resubmission, mirroring the approach taken in commit 7352e1d5932a for the related gs_usb driver (Feedly, Kernel Patch).

Successful exploitation causes a gradual accumulation of unreleased kernel memory each time a USB-in transfer completes and the device is subsequently closed. Over time, repeated connect/disconnect cycles with a usb_8dev CAN device can exhaust kernel memory, leading to system slowdown, degraded performance, or an eventual kernel crash (denial of service). There is no confidentiality or integrity impact; the vulnerability is limited to availability. Systems most at risk include embedded and IoT deployments where CAN USB devices are routinely connected and disconnected (Feedly).

• System Behavior: Gradual, sustained increase in kernel memory usage (/proc/meminfo showing decreasing MemFree/MemAvailable) correlated with usb_8dev device connect/disconnect cycles.
• Logs: Kernel messages (via dmesg) referencing the usb_8dev driver during device open/close operations; potential out-of-memory (OOM) killer events in /var/log/kern.log or journalctl -k on heavily affected systems.
• File System / Process: Unusual growth in kernel slab allocations visible via cat /proc/slabinfo or slabtop, particularly in USB-related slab caches.
• Hardware: Repeated attachment and detachment of USB CAN devices (usb_8dev-compatible) logged in dmesg as usb X-Y: new full-speed USB device entries.

Update the Linux kernel to a patched version: 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.68, 6.18.8, or 6.19-rc7 (or later stable releases). Patches are available via the upstream stable kernel tree (Kernel Patch). Ubuntu has issued multiple security notices (USN-8162-1, USN-8180-1 through USN-8180-6, USN-8186-1, USN-8188-1, USN-8275-1, USN-8297-1) addressing this issue (Ubuntu USN-8180-1). As a temporary workaround for systems that cannot be immediately patched, restrict physical USB port access to prevent unauthorized usb_8dev device connections, and monitor kernel memory usage for anomalous growth. Blacklisting the usb_8dev kernel module (echo 'blacklist usb_8dev' >> /etc/modprobe.d/blacklist.conf) is an option if the driver is not required (Feedly).

The vulnerability has received routine coverage from Linux distribution security teams, with Ubuntu issuing multiple update notices (USN-8162-1, USN-8180 series, USN-8186-1, USN-8188-1, USN-8275-1, USN-8297-1) and Oracle Linux publishing corresponding advisories. Tenable/Nessus and Qualys have both added detection plugins for this CVE. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability tracking and distribution advisory channels (Ubuntu USN-8180-1, Feedly).