PT-2026-6131 · Unknown+4 · Kvaser Usb+4
Published
2026-01-01
·
Updated
2026-05-22
·
CVE-2026-23061
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The Linux kernel contains a memory leak in the
kvaser usb module. Specifically, the issue occurs within the kvaser usb read bulk callback() function when handling USB-in transfers. The URBs (USB Request Blocks) are not consistently released, leading to a memory leak. This happens because the USB framework unanchors the URB before the completion callback is executed, and the usb kill anchored urbs() function in kvaser usb remove interfaces() does not release the unanchored URB. The fix involves anchoring the URB in the kvaser usb read bulk callback() to the dev->rx submitted anchor. The issue is similar to a previously resolved memory leak in the gs usb module (commit 7352e1d5932a).Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Memory Leak
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linuxmint
Linux Kernel
Ubuntu
Gs Usb
Kvaser Usb