PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-23108 Linux CVE debrief

A memory leak vulnerability was found in the Linux kernel's usb_8dev driver. The vulnerability occurs in the usb_8dev_read_bulk_callback() function, where a URB (USB Request Block) is not properly anchored, leading to a memory leak when the URB is completed. This vulnerability can be triggered when a USB device is plugged into a Linux system and the usb_8dev driver is used to handle the device.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-02-04
Original CVE updated
2026-10-19
Advisory published
2026-02-04
Advisory updated
2026-10-19

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux systems that use the usb_8dev driver should be aware of this vulnerability. They should review and apply the patch provided by the Linux kernel maintainers, update the Linux kernel to a version that includes the fix, and monitor system logs for signs of exploitation. Additionally, they should review compensating controls for exposed systems while remediation is and

Why it matters

A memory leak vulnerability was found in the Linux kernel's usb_8dev driver. The vulnerability occurs in the usb_8dev_read_bulk_callback() function, where a URB (USB Request Block) is not properly anchored, leading to a memory leak when the URB is completed.

  • Memory leak vulnerability can cause system resource exhaustion.
  • Vulnerability can be triggered by plugging in a USB device.
  • Fixing the vulnerability requires updating the Linux kernel.

Technical summary

The vulnerability occurs in the usb_8dev_read_bulk_callback() function, where a URB (USB Request Block) is not properly anchored, leading to a memory leak when the URB is completed. This vulnerability can be triggered when a USB device is plugged into a Linux system and the usb_8dev driver is used to handle the device. The fix involves anchoring the URB in the usb_8dev_read_bulk_callback() function to prevent the memory leak. This requires updating the Linux kernel to a version that includes the fix. Linux kernel developers and maintainers should review and apply the patch.

Defensive priority

Medium

Recommended defensive actions

  • Review and apply the patch provided by the Linux kernel maintainers.
  • Update the Linux kernel to a version that includes the fix.
  • Monitor system logs for signs of exploitation.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability was introduced in the Linux kernel and affects various versions of the Linux kernel. The vulnerability was fixed by anchoring the URB in the usb_8dev_read_bulk_callback() function. This fix prevents a memory leak when a USB device is plugged into a Linux system and the usb_8dev driver is used to handle the device. Defenders should verify that their Linux kernel versions have been updated to include this fix.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-23108 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-23108

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-23108 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-23108

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/23xxx/CVE-2026-23108.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/feb8243eaea7efd5279b19667d7189fd8654c87a

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ef6e608e5ee71eca0cd3475c737e684cef24f240

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/60719661b4cbd7ffbed1a0e0fa3bbc82d8bd2be9

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/59ff56992bba28051ad67cd8cc7b0edfe7280796

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ea4a98e924164586066b39f29bfcc7cc9da108cd

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/07e9373739c6388af9d99797cdb2e79dbbcbe92b

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f7a980b3b8f80fe367f679da376cf76e800f9480

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.