PT-2026-43971 · Linux · Linux Kernel

Published 2026-05-27 · Updated 2026-06-04 · CVE-2026-46103

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A lifetime bookkeeping error exists in the ucan driver within the CAN subsystem. USB drivers bind to USB interfaces, and device managed resources must have their lifetime tied to the interface instead of the parent USB device. Failure to do so can lead to memory leaks when drivers are unbound without the physical disconnection of devices, such as during configuration changes or probe deferral. Specifically, the control message buffer lifetime was not correctly managed, preventing its release upon driver unbind.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-46103

ECHO-A56E-4044-53B4

OPENSUSE-SU-2026:10954-1

Affected Products

Linux Kernel

References · 291

• https://osv.dev/vulnerability/openSUSE-SU-2026:10954-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-46103 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-46103 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-46103 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-46103 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-46103 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-46103 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2026-46103 · Vendor Advisory
• https://suse.com/security/cve/CVE-2026-46065 · Note
• https://suse.com/security/cve/CVE-2026-46216 · Note
• https://suse.com/security/cve/CVE-2026-46013 · Note
• https://suse.com/security/cve/CVE-2026-46009 · Note
• https://suse.com/security/cve/CVE-2026-45837 · Note
• https://suse.com/security/cve/CVE-2026-46164 · Note
• https://suse.com/security/cve/CVE-2026-46077 · Note