Cloudanix VulnDB

CVE-2026-23324

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

Mar 25, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux kernel code handling certain USB devices could let a logged-in user crash the whole system.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Failure to anchor a USB Request Block (URB) before submission in the read bulk callback of the etas_es58x CAN driver allows the URB to be leaked when usb_kill_anchored_urbs() is invoked, resulting in a use-after-free condition.

Why it matters to the business

Systems using affected Linux kernels with the etas_es58x USB CAN adapter may experience kernel instability or crashes, leading to loss of CAN bus functionality and potential downtime for industrial or automotive applications.

How an attack unfolds

An attacker with local access triggers repeated read bulk operations on the etas_es58x device while concurrently invoking usb_kill_anchored_urbs(), causing the unanchored URB to be freed prematurely and later dereferenced, resulting in a use-after-free that can be leveraged for local denial of service.

How to fix it

Apply the upstream kernel fix that anchors the URB before submission in the read bulk callback; rebuild and deploy the updated kernel module or upgrade to a kernel version containing the resolution for the etas_es58x driver.

How to confirm the fix worked

Inspect the etas_es58x driver source for the read bulk callback to confirm the usb_anchor_urb() call precedes usb_submit_urb(); test by exercising device read paths followed by usb_kill_anchored_urbs() and verify no URB leaks occur via kmemleak or similar tools.

Typical attack path

  1. Obtain local user access on a Linux system with the etas_es58x driver loaded
  2. Open and interact with the CAN USB device to initiate read bulk transfers
  3. Trigger usb_kill_anchored_urbs() via device removal or driver unload path
  4. Cause premature free of the unanchored URB and subsequent dereference

How to detect it

Review kernel logs for oops or warnings referencing etas_es58x, usb_anchor, or urb leaks; correlate with device attach/detach events and CAN interface activity.

What your security team should do

  • Prioritize kernel updates for systems exposing the etas_es58x CAN driver
  • Restrict local access to devices using this USB CAN adapter until patched
  • Monitor for kernel oops or crashes involving usb or can subsystems

The record

In the Linux kernel, the following vulnerability has been resolved: can: usb: etas_es58x: correctly anchor the urb in the read bulk callback When submitting an urb, that is using the anchor pattern, it needs to be anchored before submitting it otherwise it could be leaked if usb_kill_anchored_urbs() is called. This logic is correctly done elsewhere in the driver, except in the read bulk callback so do that here also.

Affected packages

Ecosystem Package Introduced Fixed