CVE-2026-23324

Description

In the Linux kernel, the following vulnerability has been resolved: can: usb: etas_es58x: correctly anchor the urb in the read bulk callback When submitting an urb, that is using the anchor pattern, it needs to be anchored before submitting it otherwise it could be leaked if usb_kill_anchored_urbs() is called. This logic is correctly done elsewhere in the driver, except in the read bulk callback so do that here also.

CVSS Details

CVSS Score

5.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* - VULNERABLE

Linux Kernel < 18eee279e9b5bff0db1aca9475ae4bc12804f05c

Linux Kernel < 2185ea6e4ebcb61d1224dc7d187c59723cb5ad59

Linux Kernel < 5eaad4f768266f1f17e01232ffe2ef009f8129b7

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

/*
 * PoC Concept: Vulnerability Demonstration in etas_es58x
 * This code illustrates the vulnerable logic in the read bulk callback.
 */
#include <linux/usb.h>

// Vulnerable implementation pattern
void vulnerable_read_bulk_callback(struct urb *urb) {
    struct usb_anchor *anchor = get_anchor_from_context(urb);

    // VULNERABILITY: URB is submitted BEFORE being anchored.
    // If usb_kill_anchored_urbs() is called here, the URB is leaked.
    int ret = usb_submit_urb(urb, GFP_ATOMIC);

    if (ret) {
        // Handle error
    } else {
        // Anchoring happens after submission, creating a race window.
        usb_anchor_urb(urb, anchor);
    }
}

// Fixed implementation pattern
void fixed_read_bulk_callback(struct urb *urb) {
    struct usb_anchor *anchor = get_anchor_from_context(urb);

    // FIX: Anchor the URB before submitting it.
    usb_anchor_urb(urb, anchor);

    int ret = usb_submit_urb(urb, GFP_ATOMIC);

    if (ret) {
        // If submission fails, unanchor to prevent leaks
        usb_unanchor_urb(urb);
    }
}

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-23324
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-23324
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-23324/
[4] VulDB https://vuldb.com/cve/CVE-2026-23324
[5] https://git.kernel.org/stable/c/18eee279e9b5bff0db1aca9475ae4bc12804f05c
[6] https://git.kernel.org/stable/c/2185ea6e4ebcb61d1224dc7d187c59723cb5ad59
[7] https://git.kernel.org/stable/c/5eaad4f768266f1f17e01232ffe2ef009f8129b7
[8] https://git.kernel.org/stable/c/7a0171b4921ad443fee5ed4fcb9d99fa4776edac
[9] https://git.kernel.org/stable/c/b878444519fa03a3edd287d1963cf79ef78be2f1
[10] https://git.kernel.org/stable/c/b8f9ca88253574638bcff38900a4c28d570b1919
[11] https://git.kernel.org/stable/c/f6e90c113c92e83fc0963d5e60e16b0e8a268981

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-23324", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-03-25T11:16:29.377", "lastModified": "2026-04-23T21:05:15.090", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: usb: etas_es58x: correctly anchor the urb in the read bulk callback\n\nWhen submitting an urb, that is using the anchor pattern, it needs to be\nanchored before submitting it otherwise it could be leaked if\nusb_kill_anchored_urbs() is called. This logic is correctly done\nelsewhere in the driver, except in the read bulk callback so do that\nhere also."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncan: usb: etas_es58x: anclar correctamente el urb en la función de devolución de llamada de lectura masiva\n\nAl enviar un urb, que está usando el patrón de anclaje, necesita ser anclado antes de enviarlo, de lo contrario, podría filtrarse si se llama a usb_kill_anchored_urbs(). Esta lógica se realiza correctamente en otras partes del controlador, excepto en la función de devolución de llamada de lectura masiva, así que hazlo aquí también."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13.1", "versionEndExcluding": "5.15.203", "matchCriteriaId": "CC3F58C6-09EC-41E6-8E82-613F5965C0DB"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.1.167", "matchCriteriaId": "2EDC6BAF-B710-4E26-B6AA-D68922EE7B43"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.6.130", "matchCriteriaId": "C57BB918-DF28-46B3-94F7-144176841267"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.12.77", "matchCriteriaId": "B3D12E00-E42D-4056-B354-BAD4903C03A5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.17", "matchCriteriaId": "A5E006E4-59C7-43C1-9231-62A72219F2BA"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.7", "matchCriteriaId": "69245D10-0B71-485E-80C3-A64F077004D3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:5.13:-:*:*:*:*:*:*", "matchCriteriaId": "8F0E7012-0BA3-4E6A-ADE9-57973CBDEE28"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/18eee279e9b5bff0db1aca9475ae4bc12804f05c", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/2185ea6e4ebcb61d1224dc7d187c59723cb5ad59", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/5eaad4f768266f1f17e01232ffe2ef009f8129b7", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/7a0171b4921ad443fee5ed4fcb9d99fa4776edac", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.o ... (truncated)