Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-74459

can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.15.216, 6.1.183, 6.6.151, 6.12.103, 6.18.44, and 1 more
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure es58x_read_bulk_callback() resubmits the RX URB after processing a received packet. If the resubmit succeeds, the URB remains anchored and will be handled by the normal RX path or by teardown. However, if usb_submit_urb() fails, the callback unanchors the URB and then returns directly. This skips the existing free_urb path, so the coherent transfer buffer allocated with usb_alloc_coherent() is not released. Reuse the existing free_urb path after a resubmit failure so that the RX coherent buffer is freed before leaving the callback.

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    From 5.15.203 · fixed in 5.15.216; From 6.1.167 · fixed in 6.1.183; From 6.6.130 · fixed in 6.6.151; From 6.12.77 · fixed in 6.12.103; From 6.18.17 · fixed in 6.18.44; From 6.19.7 · fixed in 6.20

  • Linux Linux

    7.0

References 7

git.kernel.org