PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46103 Linux CVE debrief

A memory management vulnerability in the Linux kernel's USB CAN driver (ucan) could lead to resource leaks when drivers are unbound without physical disconnection. The issue stems from improper device resource (devres) lifetime management where control message buffers were tied to the parent USB device rather than the USB interface. This affects scenarios such as probe deferral or configuration changes where the driver unbinds but resources persist. The vulnerability has been resolved by correcting the buffer lifetime to release on driver unbind.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-25
Advisory published
2026-05-27
Advisory updated
2026-06-25

Who should care

Organizations running Linux systems with USB CAN bus interfaces, particularly those with dynamic USB configurations, hot-plugging scenarios, or industrial/automotive applications using CAN over USB adapters.

Technical summary

The ucan USB CAN driver in the Linux kernel incorrectly tied device-managed resource (devres) lifetimes to the parent USB device rather than the USB interface. This caused control message buffers to persist when drivers unbound without physical disconnection, such as during probe deferral or configuration changes. The fix corrects the resource lifetime so buffers release on driver unbind, preventing memory leaks in dynamic USB configuration scenarios.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the referenced stable commits when available for your distribution
  • Monitor vendor security advisories for kernel package updates addressing CVE-2026-46103
  • For systems using USB CAN devices, verify driver unbind/rebind operations complete without resource leaks after patching
  • Review systems with frequent USB configuration changes or probe deferral scenarios for memory pressure indicators

Evidence notes

The CVE description and kernel commit references confirm this is a devres lifetime fix in the can/ucan USB driver. Multiple stable kernel commits are referenced, indicating backports to supported branches. The fix ensures control message buffers are released when the driver unbinds rather than persisting until physical disconnection.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46103 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46103

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46103 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46103

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/10b7b676b78a7bd888d19729b459aad7fc1f428b

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/4b7d07747400cfd7eff1ba7b8b5a7c8d5a58f705

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c0d3ccc6929e4509076df8f30a4fb1dc5018b0ae

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c524c124e3094d2de12235a513854c03d06a2b58

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/fed4626501c871890da287bec62a96e52da1af89

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.