Linux CVE-2026-23347

The vulnerability resides in the Linux kernel's CAN (Controller Area Network) USB driver for Fintek f81604 devices, part of the broader USB subsystem. The issue involves improper resource management of USB Request Blocks (URBs), which are the fundamental data structures for USB communication in Linux. URBs submitted to the USB core must be anchored to a usb_anchor structure before submission to ensure proper lifetime management and cleanup via usb_kill_anchored_urbs(). The CWE classification relates to resource management and use-after-free patterns—specifically, the read bulk callback submits URBs without anchoring them first, violating the established pattern used elsewhere in the same driver. This creates a window where URBs can be submitted but not tracked by the anchor mechanism, leading to potential memory leaks or access to freed memory during device removal. Affected products are identified via CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* for all Linux kernel versions prior to the patch.