Strix
26.1K

CVE-2026-23031

UnknownEPSS 0.20%

Last modified

CVE-2026-23031 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak In gs_can_open(), the URBs for USB-in transfers are allocated, added to the parent->rx_submitted anchor and submitted. In the complete callback gs_usb_receive_bulk_callback(), the URB is processed and resubmitted. EPSS estimates a 0.20% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak In gs_can_open(), the URBs for USB-in transfers are allocated, added to the parent->rx_submitted anchor and submitted. In the complete callback gs_usb_receive_bulk_callback(), the URB is processed and resubmitted. In gs_can_close() the URBs are freed by calling usb_kill_anchored_urbs(parent->rx_submitted). However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in gs_can_close(). Fix the memory leak by anchoring the URB in the gs_usb_receive_bulk_callback() to the parent->rx_submitted anchor.

Metrics

EPSS Probability
0.20%

9.6th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= d08e973a77d128b25e01a08c34d89593fdf222da, < 9c151898cc259a7784be60ba38664f42ede39b31; >= d08e973a77d128b25e01a08c34d89593fdf222da, < ec5ccc2af9e5b045671f3f604b57512feda8bcc5; >= d08e973a77d128b25e01a08c34d89593fdf222da, < f905bcfa971edb89e398c98957838d8c6381c0c7; >= d08e973a77d128b25e01a08c34d89593fdf222da, < 08624b7206ddb9148eeffc2384ebda2c47b6d1e9; >= d08e973a77d128b25e01a08c34d89593fdf222da, < 9f669a38ca70839229b7ba0f851820850a2fe1f7; >= d08e973a77d128b25e01a08c34d89593fdf222da, < 7352e1d5932a0e777e39fa4b619801191f57e603
LinuxLinux3.16

References

Timeline

Published
Last Modified
Status
Deferred

Frequently Asked Questions

What is CVE-2026-23031?
In the Linux kernel, the following vulnerability has been resolved: can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak In gs_can_open(), the URBs for USB-in transfers are allocated, added to the parent->rx_submitted anchor and submitted. In the complete callback gs_usb_receive_bulk_callback(), the URB is processed and resubmitted. In gs_can_close() the URBs are freed by calling usb_kill_anchored_urbs(parent->rx_submitted). However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in gs_can_close(). Fix the memory leak by anchoring the URB in the gs_usb_receive_bulk_callback() to the parent->rx_submitted anchor.
How severe is CVE-2026-23031?
Severity scoring for CVE-2026-23031 is pending analysis. The EPSS model estimates a 0.20% probability of exploitation in the next 30 days.
How do I fix CVE-2026-23031?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-23031?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST