CVE-2026-23324: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23324 is a resource leak vulnerability in the Linux kernel's CAN USB driver (etas_es58x) where a USB request block (urb) is not properly anchored before submission in the read bulk callback. When an urb using the anchor pattern is submitted without being anchored first, it can be leaked if usb_kill_anchored_urbs() is called. The vulnerability affects Linux kernel versions from 5.13 through multiple stable branches up to (but not including) 6.1.167, 5.15.203, 6.6.130, 6.12.77, 6.18.17, 6.19.7, and pre-release 7.0-rc3. It was disclosed on March 25, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Feedly).

The root cause is classified as CWE-772 (Missing Release of Resource after Effective Lifetime). In the etas_es58x CAN USB driver, the read bulk callback submits a urb using the anchor pattern but fails to anchor it prior to submission — unlike other code paths in the same driver that handle this correctly. If usb_kill_anchored_urbs() is called (e.g., during device disconnect or driver teardown) before the urb completes, the unanchored urb is not tracked and cannot be properly cleaned up, resulting in a kernel memory leak. The attack vector is local (AV:L), requires low privileges (PR:L), and no user interaction (Red Hat Advisory, Feedly).

Successful exploitation primarily affects availability: repeated triggering of the urb leak can exhaust kernel memory, potentially causing denial of service through system crash or hang. There is no direct confidentiality or integrity impact under normal conditions; however, in certain scenarios, memory corruption arising from the leaked urb could theoretically lead to privilege escalation or arbitrary code execution at the kernel level. The vulnerability is scoped to systems with the etas_es58x CAN USB driver loaded and a connected ETAS ES58x CAN-USB device (Feedly).

The Linux kernel stable branches have been patched; administrators should update to the following fixed versions: 6.1.167, 5.15.203, 6.6.130, 6.12.77, 6.18.17, 6.19.7, or 7.0-rc3 and later. Patch commits are available in the Linux kernel git repository (kernel.org patches). As a workaround where immediate patching is not possible, disable or blacklist the etas_es58x kernel module if CAN USB functionality is not required, and restrict physical USB device access on affected systems. Vendor-specific updates are also available from Red Hat, SUSE (SUSE Advisory), and Debian (Debian DSA).

Red Hat, SUSE, Debian, and Microsoft (for Azure Linux) have all issued advisories or updates addressing this vulnerability. Tenable has released Nessus detection plugins (e.g., plugin 303700, 311299, 311783) for identifying affected systems. The Yocto Project security mailing list also flagged the issue for embedded Linux users. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vendor patch tracking (Red Hat Advisory, SUSE Advisory, Debian DSA).