CVE-2026-23061

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a memory leak in the kvaser usb module. Specifically, the issue occurs within the kvaser usb read bulk callback() function when handling USB-in transfers. The URBs (USB Request Blocks) are not consistently released, leading to a memory leak. This happens because the USB framework unanchors the URB before the completion callback is executed, and the usb kill anchored urbs() function in kvaser usb remove interfaces() does not release the unanchored URB. The fix involves anchoring the URB in the kvaser usb read bulk callback() to the dev->rx submitted anchor. The issue is similar to a previously resolved memory leak in the gs usb module (commit 7352e1d5932a).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.