Cloudanix VulnDB

CVE-2026-23347

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

Mar 25, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in how Linux handles certain USB devices could let a logged-in user crash the whole computer.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in the Linux kernel CAN USB driver (f81604) caused by submitting a read bulk URB without anchoring it first, so usb_kill_anchored_urbs can free the URB while it is still in use.

Why it matters to the business

Local users on affected Linux systems can trigger kernel crashes or memory corruption, leading to denial of service on devices using this CAN-over-USB hardware.

How an attack unfolds

An attacker with local access triggers the read bulk callback, then causes usb_kill_anchored_urbs to be invoked, freeing the unanchored URB and allowing reuse of the dangling pointer.

How to fix it

Update the Linux kernel to a version containing the fix that anchors the URB before submission in the read bulk callback; apply vendor-supplied kernel packages as soon as available.

How to confirm the fix worked

Confirm the presence of the anchoring call before usb_submit_urb in the read bulk callback path and verify the driver no longer leaks URBs under usb_kill_anchored_urbs stress tests.

Typical attack path

  1. Obtain local shell or code execution on the target Linux system
  2. Load or interact with the f81604 CAN USB driver to reach the read bulk callback
  3. Trigger submission of the unanchored URB followed by usb_kill_anchored_urbs
  4. Reuse the freed URB memory to cause kernel panic or corruption

How to detect it

Inspect kernel ring buffer and dmesg for oops or slab-use-after-free reports referencing f81604 or usb_anchor; review audit logs for processes opening CAN USB character devices.

What your security team should do

  • Prioritize kernel updates on all systems exposing the f81604 driver
  • Restrict local user access to CAN USB devices until patched
  • Monitor kernel logs for URB-related warnings or oops after applying updates

The record

In the Linux kernel, the following vulnerability has been resolved: can: usb: f81604: correctly anchor the urb in the read bulk callback When submitting an urb, that is using the anchor pattern, it needs to be anchored before submitting it otherwise it could be leaked if usb_kill_anchored_urbs() is called. This logic is correctly done elsewhere in the driver, except in the read bulk callback so do that here also.

Affected packages

Ecosystem Package Introduced Fixed