CVE-2026-23347
published 2026-03-25CVE-2026-23347: In the Linux kernel, the following vulnerability has been resolved: can: usb: f81604: correctly anchor the urb in the read bulk callback When submitting an…
PriorityP419medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.13%
2.8th percentile
In the Linux kernel, the following vulnerability has been resolved:
can: usb: f81604: correctly anchor the urb in the read bulk callback
When submitting an urb, that is using the anchor pattern, it needs to be
anchored before submitting it otherwise it could be leaked if
usb_kill_anchored_urbs() is called. This logic is correctly done
elsewhere in the driver, except in the read bulk callback so do that
here also.
Affected
35 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.19.8-1 (forky) | linux 6.19.8-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= 88da17436973e463bed59bea79771fb03a21555e < 54ee74307165b348b2fddcd7942eb48fb4ee1237 | 54ee74307165b348b2fddcd7942eb48fb4ee1237 |
| linux | linux | >= 88da17436973e463bed59bea79771fb03a21555e < c001214e12202338425d6dda5d2a1919d674282d | c001214e12202338425d6dda5d2a1919d674282d |
| linux | linux | >= 88da17436973e463bed59bea79771fb03a21555e < f6d80b104f904a6da922907394eec66d3e2ffc57 | f6d80b104f904a6da922907394eec66d3e2ffc57 |
| linux | linux | >= 88da17436973e463bed59bea79771fb03a21555e < 7724645c4792914cd07f36718816c5369cc57970 | 7724645c4792914cd07f36718816c5369cc57970 |
| linux | linux | >= 88da17436973e463bed59bea79771fb03a21555e < 952caa5da10bed22be09612433964f6877ba0dde | 952caa5da10bed22be09612433964f6877ba0dde |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.19.8-1 | 6.19.8-1 |
| linux | linux_kernel | >= 6.13 < 6.18.17 | 6.18.17 |
| linux | linux_kernel | >= 6.13.0 < 6.18.17 | 6.18.17 |
| linux | linux_kernel | >= 6.19 < 6.19.7 | 6.19.7 |
| linux | linux_kernel | >= 6.19.0 < 6.19.7 | 6.19.7 |
| linux | linux_kernel | >= 6.5.0 < 6.6.130 | 6.6.130 |
| linux | linux_kernel | >= 6.5.1 < 6.6.130 | 6.6.130 |
| linux | linux_kernel | >= 6.7 < 6.12.77 | 6.12.77 |
| linux | linux_kernel | >= 6.7.0 < 6.12.77 | 6.12.77 |
| msrc | azl3_kernel_6.6.126.1-1_on_azure_linux_3.0 | — | — |
| ubuntu | linux | — | — |
| ubuntu | linux-fips | — | — |
| ubuntu | linux-gcp | — | — |
| ubuntu | linux-gcp-6.8 | — | — |
| ubuntu | linux-gcp-fips | — | — |
| ubuntu | linux-gke | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_msrc5.5MEDIUM
vendor_ubuntu2.0LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (Oracle) vulnerabilities
vendor_ubuntu·2026-07-23·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel (Oracle) vulnerabilities
Title: Linux kernel (Oracle) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A loca
Ubuntu
Linux kernel (NVIDIA) vulnerabilities
vendor_ubuntu·2026-07-23·CVSS 2.0
CVE-2026-43129 [LOW] Linux kernel (NVIDIA) vulnerabilities
Title: Linux kernel (NVIDIA) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A loca
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-23·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local attacke
Ubuntu
Linux kernel (GCP FIPS) vulnerabilities
vendor_ubuntu·2026-07-21·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel (GCP FIPS) vulnerabilities
Title: Linux kernel (GCP FIPS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A lo
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-20·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local attacke
Red Hat
kernel: can: usb: f81604: correctly anchor the urb in the read bulk callback
vendor_redhat·2026-03-25
CVE-2026-23347 CWE-771 kernel: can: usb: f81604: correctly anchor the urb in the read bulk callback
kernel: can: usb: f81604: correctly anchor the urb in the read bulk callback
In the Linux kernel, the following vulnerability has been resolved:
can: usb: f81604: correctly anchor the urb in the read bulk callback
When submitting an urb, that is using the anchor pattern, it needs to be
anchored before submitting it otherwise it could be leaked if
usb_kill_anchored_urbs() is called. This logic is correctly done
elsewhere in the driver, except in the read bulk callback so do that
here also.
A flaw was found in the Linux kernel's `can: usb: f81604` driver. When a USB Request Block (urb) is submitted, it is not correctly anchored in the read bulk callback. This oversight could lead to a resource leak if `usb_kill_anchored_urbs()` is called, potentially resulting in a Denial of Service (DoS)
Microsoft
can: usb: f81604: correctly anchor the urb in the read bulk callback
vendor_msrc·2026-03-10·CVSS 5.5
CVE-2026-23347 [MEDIUM] can: usb: f81604: correctly anchor the urb in the read bulk callback
can: usb: f81604: correctly anchor the urb in the read bulk callback
Mariner: Mariner
Linux: Linux
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
Debian
CVE-2026-23347: linux - In the Linux kernel, the following vulnerability has been resolved: can: usb: f...
vendor_debian·2026
CVE-2026-23347 [LOW] CVE-2026-23347: linux - In the Linux kernel, the following vulnerability has been resolved: can: usb: f...
In the Linux kernel, the following vulnerability has been resolved: can: usb: f81604: correctly anchor the urb in the read bulk callback When submitting an urb, that is using the anchor pattern, it needs to be anchored before submitting it otherwise it could be leaked if usb_kill_anchored_urbs() is called. This logic is correctly done elsewhere in the driver, except in the read bulk callback so do that here also.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 6.19.8-1)
sid: resolved (fixed in 6.19.8-1)
trixie: open
OSV
can: usb: f81604: correctly anchor the urb in the read bulk callback
osv·2026-03-25
CVE-2026-23347 can: usb: f81604: correctly anchor the urb in the read bulk callback
can: usb: f81604: correctly anchor the urb in the read bulk callback
In the Linux kernel, the following vulnerability has been resolved:
can: usb: f81604: correctly anchor the urb in the read bulk callback
When submitting an urb, that is using the anchor pattern, it needs to be
anchored before submitting it otherwise it could be leaked if
usb_kill_anchored_urbs() is called. This logic is correctly done
elsewhere in the driver, except in the read bulk callback so do that
here also.
GHSA
GHSA-75xj-x496-vm4v: In the Linux kernel, the following vulnerability has been resolved:
can: usb: f81604: correctly anchor the urb in the read bulk callback
When submit
ghsa_unreviewed·2026-03-25
CVE-2026-23347 GHSA-75xj-x496-vm4v: In the Linux kernel, the following vulnerability has been resolved:
can: usb: f81604: correctly anchor the urb in the read bulk callback
When submit
In the Linux kernel, the following vulnerability has been resolved:
can: usb: f81604: correctly anchor the urb in the read bulk callback
When submitting an urb, that is using the anchor pattern, it needs to be
anchored before submitting it otherwise it could be leaked if
usb_kill_anchored_urbs() is called. This logic is correctly done
elsewhere in the driver, except in the read bulk callback so do that
here also.
OSV
CVE-2026-23347: In the Linux kernel, the following vulnerability has been resolved: can: usb: f81604: correctly anchor the urb in the read bulk callback When submitti
osv·2026-03-25
CVE-2026-23347 CVE-2026-23347: In the Linux kernel, the following vulnerability has been resolved: can: usb: f81604: correctly anchor the urb in the read bulk callback When submitti
In the Linux kernel, the following vulnerability has been resolved: can: usb: f81604: correctly anchor the urb in the read bulk callback When submitting an urb, that is using the anchor pattern, it needs to be anchored before submitting it otherwise it could be leaked if usb_kill_anchored_urbs() is called. This logic is correctly done elsewhere in the driver, except in the read bulk callback so do that here also.
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/54ee74307165b348b2fddcd7942eb48fb4ee1237https://git.kernel.org/stable/c/7724645c4792914cd07f36718816c5369cc57970https://git.kernel.org/stable/c/952caa5da10bed22be09612433964f6877ba0ddehttps://git.kernel.org/stable/c/c001214e12202338425d6dda5d2a1919d674282dhttps://git.kernel.org/stable/c/f6d80b104f904a6da922907394eec66d3e2ffc57
2026-03-25
Published