CVE-2026-23108: Linux Kernel URB Memory Leak Vulnerability

CVE-2026-23108 Overview

CVE-2026-23108 is a memory leak vulnerability in the Linux kernel's usb_8dev CAN (Controller Area Network) USB driver. The flaw resides in the usb_8dev_read_bulk_callback() function, where completed USB Request Blocks (URBs) are not re-anchored after the USB framework unanchors them prior to invoking the completion callback. As a result, calls to usb_kill_anchored_urbs(&priv->rx_submitted) during device close fail to release these URBs, producing a kernel memory leak [CWE-401]. The issue mirrors a previously resolved leak in the gs_usb driver (commit 7352e1d5932a).

Critical Impact
A local user with access to the CAN USB device can trigger sustained kernel memory consumption, eventually leading to resource exhaustion and denial of service on affected systems.

Affected Products

Linux Kernel (multiple stable branches receiving backports)
Linux Kernel 6.19-rc1 through 6.19-rc6
Systems using the usb_8dev CAN USB driver (8 devices USB2CAN interface)

Discovery Timeline

2026-02-04 - CVE-2026-23108 published to NVD
2026-03-18 - Last updated in NVD database

Technical Details for CVE-2026-23108

Vulnerability Analysis

The usb_8dev driver supports USB-to-CAN adapters from 8 devices. During usb_8dev_open(), the driver calls usb_8dev_start(), which allocates URBs for USB-in transfers, anchors them to priv->rx_submitted via usb_anchor_urb(), and submits them. When data arrives, usb_8dev_read_bulk_callback() processes the payload and resubmits the URB.

The USB core unanchors a URB immediately before invoking its completion handler. Because the driver does not re-anchor the URB after resubmission inside the callback, the URB becomes detached from the rx_submitted anchor list. On device teardown, usb_8dev_close() invokes unlink_all_urbs(), which calls usb_kill_anchored_urbs(&priv->rx_submitted) to free outstanding URBs. URBs no longer present on the anchor are never killed or freed, leaking kernel memory on every open/close cycle.

Root Cause

The root cause is a missing call to usb_anchor_urb() inside usb_8dev_read_bulk_callback() prior to resubmission. The driver assumed URBs would remain anchored across the completion lifecycle, but the USB framework explicitly unanchors before dispatching the callback. This violates the contract required by usb_kill_anchored_urbs()-based cleanup, classifying the flaw under CWE-401 (Missing Release of Memory after Effective Lifetime).

Attack Vector

Exploitation requires local access and the ability to interact with a usb_8dev CAN USB device, such as plug/unplug events or repeated open/close cycles of the CAN network interface. Each cycle leaks kernel memory associated with the in-flight URBs. The vulnerability does not impact confidentiality or integrity, but sustained triggering exhausts kernel memory and degrades system availability. The fix re-anchors the URB to priv->rx_submitted inside the bulk read callback so that subsequent teardown correctly releases all submitted URBs.

Detection Methods for CVE-2026-23108

Indicators of Compromise

Steady growth in kernel slab memory allocations attributable to USB URB structures without a corresponding workload increase.
Repeated bring-up and tear-down of CAN network interfaces backed by usb_8dev adapters in kernel logs (dmesg).
Out-of-memory (OOM) killer activations on long-running hosts using CAN USB hardware.

Detection Strategies

Audit loaded kernel modules for the usb_8dev driver on systems with CAN connectivity and correlate uptime with memory pressure trends.
Use kmemleak on test or staging kernels to confirm URB-related leaks tied to the usb_8dev driver path.
Monitor /proc/slabinfo for unexpected growth of URB and USB-related slab caches over time.

Monitoring Recommendations

Track kernel memory utilization metrics on hosts with CAN USB hardware and alert on sustained upward trends.
Log USB device attach, detach, and CAN interface state changes for correlation with memory consumption.
Centralize kernel telemetry and process-level memory metrics from Linux endpoints into your SIEM for trend analysis.

How to Mitigate CVE-2026-23108

Immediate Actions Required

Identify Linux hosts running affected kernel versions that load the usb_8dev driver and inventory connected CAN USB devices.
Apply the upstream stable kernel updates that include the fix re-anchoring URBs in usb_8dev_read_bulk_callback().
For systems that cannot be patched immediately, restrict physical and administrative access to CAN USB interfaces.

Patch Information

The fix is available across multiple stable branches via the following kernel commits: Kernel Git Commit 07e9373, Kernel Git Commit 59ff569, Kernel Git Commit 6071966, Kernel Git Commit ea4a98e, Kernel Git Commit ef6e608, Kernel Git Commit f7a980b, and Kernel Git Commit feb8243. The patch anchors the URB to priv->rx_submitted before resubmission in the bulk read callback.

Workarounds

Blacklist the usb_8dev kernel module on hosts that do not require CAN USB connectivity using modprobe configuration.
Avoid repeated open/close cycles of usb_8dev-backed CAN interfaces on unpatched systems to slow memory growth.
Schedule periodic reboots of affected systems until the patched kernel is deployed to reclaim leaked memory.

bash

# Blacklist the vulnerable driver until the kernel is patched
echo "blacklist usb_8dev" | sudo tee /etc/modprobe.d/blacklist-usb_8dev.conf
sudo update-initramfs -u
sudo reboot