Executive brief
A vulnerability was identified in the Linux kernel's UCAN driver, which handles communication with certain USB-based CAN network devices. The issue involves improper memory management that can lead to memory leaks when the driver is stopped or reconfigured without the physical device being unplugged. While primarily a stability concern, persistent memory leaks can eventually degrade system performance or cause service interruptions.
Technical details
A resource management issue exists in the ucan_probe function within drivers/net/can/usb/ucan.c. The driver incorrectly tied the lifetime of the control message buffer (ctl_msg_buffer) to the parent USB device rather than the specific USB interface. This root cause leads to memory leaks when the driver is unbound during probe deferral or configuration changes without physical disconnection. An attacker with local access could potentially trigger these conditions to exhaust system memory over time. The fix involves changing the devm_kzalloc allocation to use the interface device (&intf->dev) instead of the parent device (&udev->dev).
Affected products
- Linux Linux Kernel 4.19 and later
Timeline
- 2026-03-27: other: Patch authored by Johan Hovold
- 2026-05-27: advisory: NVD published the CVE record
References
- https://git.kernel.org/stable/c/10b7b676b78a7bd888d19729b459aad7fc1f428b
- https://git.kernel.org/stable/c/4b7d07747400cfd7eff1ba7b8b5a7c8d5a58f705
- https://git.kernel.org/stable/c/c0d3ccc6929e4509076df8f30a4fb1dc5018b0ae
- https://git.kernel.org/stable/c/c524c124e3094d2de12235a513854c03d06a2b58
- https://git.kernel.org/stable/c/fed4626501c871890da287bec62a96e52da1af89