CVE-2026-23037 in Linux
Summary
by MITRE • 01/31/2026
In the Linux kernel, the following vulnerability has been resolved:
can: etas_es58x: allow partial RX URB allocation to succeed
When es58x_alloc_rx_urbs() fails to allocate the requested number of URBs but succeeds in allocating some, it returns an error code. This causes es58x_open() to return early, skipping the cleanup label 'free_urbs', which leads to the anchored URBs being leaked.
As pointed out by maintainer Vincent Mailhol, the driver is designed to handle partial URB allocation gracefully. Therefore, partial allocation should not be treated as a fatal error.
Modify es58x_alloc_rx_urbs() to return 0 if at least one URB has been allocated, restoring the intended behavior and preventing the leak in es58x_open().
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 06/02/2026
The vulnerability described in CVE-2026-23037 resides within the Linux kernel's CAN (Controller Area Network) subsystem, specifically in the etas_es58x driver that manages ETAS ES58x CAN controllers. This issue represents a memory leak condition that occurs during the driver initialization process when attempting to allocate receive USB Request Blocks (URBs). The problem manifests when the driver's allocation function encounters partial success in URB allocation, where some but not all requested URBs can be secured. The driver's current implementation treats any failure in allocating the complete requested number of URBs as a fatal error, causing premature function termination and preventing proper cleanup operations from executing.
The technical flaw stems from improper error handling logic within the es58x_alloc_rx_urbs() function which is responsible for allocating URBs for receive operations in the USB-based CAN controller. When this function fails to allocate the full requested quantity of URBs but manages to secure at least one URB, it returns an error code that propagates up through the call stack. This error code causes the es58x_open() function to exit early before reaching the cleanup label 'free_urbs', which is essential for properly releasing previously allocated URB resources. The result is a memory leak where anchored URBs remain allocated and unreleased, creating a resource exhaustion condition that could potentially degrade system performance or lead to system instability over time.
This vulnerability directly impacts the operational reliability of systems using ETAS ES58x CAN controllers, particularly in automotive and industrial applications where these controllers are commonly deployed. The memory leak occurs during driver initialization, meaning that each failed URB allocation attempt results in a permanent resource loss. The issue is particularly concerning because the driver is designed to handle partial URB allocation gracefully according to the maintainer's design intent, yet the current implementation contradicts this design principle by treating partial success as failure. This creates a scenario where the system's memory management becomes inefficient, potentially leading to increased memory pressure and reduced system responsiveness, especially in environments with frequent driver initialization cycles.
The fix implemented addresses the root cause by modifying the es58x_alloc_rx_urbs() function to return zero (success) when at least one URB has been successfully allocated, regardless of whether the complete requested number was obtained. This change restores the intended behavior where partial URB allocation is treated as a recoverable condition rather than a fatal error. The modification ensures that the es58x_open() function continues execution past the early return point, allowing the cleanup code labeled 'free_urbs' to execute properly and release all allocated URB resources. This approach aligns with the driver's documented design principles and follows standard practices for resource management in kernel drivers where partial success conditions should not necessarily result in complete failure states. The solution adheres to CWE-459 principles regarding incomplete cleanup and addresses ATT&CK technique T1490 related to resource exhaustion through improper resource management.
The fix demonstrates proper kernel driver development practices by ensuring that resource cleanup paths are always executed regardless of allocation outcomes, preventing resource leaks that could accumulate over time. This vulnerability highlights the importance of careful error handling in kernel space where partial failures should not prevent proper resource management and cleanup operations. The modification maintains backward compatibility while restoring the expected behavior of the driver, ensuring that systems using ETAS ES58x controllers operate reliably without the risk of gradual memory consumption due to unallocated URB resources. The solution represents a minimal but effective change that preserves all existing functionality while correcting the resource leak behavior that could otherwise compromise system stability in long-running applications.