CVE-2026-23347: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23347 is a resource leak vulnerability in the Linux kernel's CAN USB driver (f81604) within the read bulk callback function. When submitting a URB (USB Request Block) using the anchor pattern, the URB must be anchored before submission; failure to do so can cause it to be leaked if usb_kill_anchored_urbs() is called. The flaw was published on March 25, 2026, and affects Linux kernel versions 6.5 through 6.6.129, 6.7 through 6.12.76, 6.13 through 6.18.16, 6.19 through 6.19.6, and 7.0-rc1 through 7.0-rc6; Microsoft's Azure Linux kernel version 6.6.126.1-1 is also affected. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Microsoft MSRC).

The root cause is classified as CWE-771 (Missing Reference to Active Allocated Resource): the read bulk callback in the f81604 CAN USB driver submits a URB without first anchoring it, unlike the correct pattern used elsewhere in the same driver. If usb_kill_anchored_urbs() is called while an unanchored URB is in flight, the URB is not tracked and therefore cannot be properly cleaned up, resulting in a memory leak. Exploitation requires local access with low privileges and no user interaction; an attacker can repeatedly trigger the vulnerable code path by interacting with a CAN USB device to exhaust kernel memory. No public proof-of-concept code has been identified (Red Hat Advisory, Feedly).

Successful exploitation leads to a denial-of-service (DoS) condition through progressive kernel memory exhaustion. A local attacker with low privileges can repeatedly trigger the URB leak in the read bulk callback, degrading system stability and potentially causing an out-of-memory condition that crashes or severely impairs the affected host. There is no impact on confidentiality or integrity; the vulnerability is limited to availability (Red Hat Advisory).

Apply the available kernel patches, which fix the issue by correctly anchoring the URB before submission in the read bulk callback. Fixed versions include Linux kernel 6.6.130, 6.12.77, 6.18.17, 6.19.7, and 7.0-rc7 or later; patch commits are available in the Linux kernel stable tree (kernel.org patch 1, kernel.org patch 2). For systems that cannot be patched immediately, consider disabling CAN USB device support if not operationally required, restricting local user access to systems with CAN USB interfaces, and implementing memory usage monitoring to detect abnormal consumption patterns (Red Hat Advisory).

Red Hat tracked the issue via Bugzilla (BZ#2451173) and Microsoft addressed it in their Azure Linux kernel (version 6.6.126.1-1) through the MSRC advisory process. Distribution-level advisories have been issued by Debian and SUSE, and Tenable has published Nessus detection plugins (IDs 303654 and 311299) for the vulnerability. No notable researcher commentary or significant social media discussion has been observed beyond routine patch tracking (Microsoft MSRC, Red Hat Advisory).