Junglewise Threat Intelligence

CVE-2026-23037: Linux Kernel memory leak in etas_es58x CAN USB driver

CVE-2026-23037 · Severity: info · CVSS 2.1 · Published 2026-01-31

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A memory leak vulnerability was identified in the Linux kernel's ETAS ES58X CAN USB driver. This driver is used to interface with specific automotive diagnostic hardware. If the system fails to fully allocate resources when opening the device, it may leak memory, which could eventually lead to system instability or performance degradation.

Technical details

A memory leak exists in the etas_es58x driver within the Linux kernel's CAN subsystem. The vulnerability is located in the es58x_alloc_rx_urbs() function, which returns an error code if it fails to allocate the full requested number of USB Request Blocks (URBs), even if some were successfully allocated. This error causes es58x_open() to exit early and bypass the 'free_urbs' cleanup label, resulting in anchored URBs being leaked. The fix modifies the driver to treat partial URB allocation as a success (returning 0) if at least one URB is allocated, which is consistent with the driver's design to handle partial allocations gracefully.

Affected products

  • Linux Linux Kernel Fixed in versions 6.1.128, 6.6.75, 6.12.12, 6.13.1, and 6.14-rc1

Timeline

  • 2025-12-23: other: Patch submitted by developer
  • 2026-01-30: patched: Patch committed to stable tree
  • 2026-01-31: disclosed: CVE published

References