CVE-2026-23031

Published Jan 31, 2026

Overview

CVE-2026-23031 is a known-severity vulnerability. It was published on January 31, 2026.

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak

In gs_can_open(), the URBs for USB-in transfers are allocated, added to the

parent->rx_submitted anchor and submitted. In the complete callback

gs_usb_receive_bulk_callback(), the URB is processed and resubmitted. In

gs_can_close() the URBs are freed by calling

usb_kill_anchored_urbs(parent->rx_submitted).

However, this does not take into account that the USB framework unanchors

the URB before the complete function is called. This means that once an

in-URB has been completed, it is no longer anchored and is ultimately not

released in gs_can_close().

Fix the memory leak by anchoring the URB in the

gs_usb_receive_bulk_callback() to the parent->rx_submitted anchor.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References

Ref git.kernel.org/stable/c/08624b7206ddb9148eeffc2384ebda2c47b6d1e9 Ref git.kernel.org/stable/c/7352e1d5932a0e777e39fa4b619801191f57e603 Ref git.kernel.org/stable/c/9c151898cc259a7784be60ba38664f42ede39b31 Ref git.kernel.org/stable/c/9f669a38ca70839229b7ba0f851820850a2fe1f7 Ref git.kernel.org/stable/c/ec5ccc2af9e5b045671f3f604b57512feda8bcc5 Ref git.kernel.org/stable/c/f905bcfa971edb89e398c98957838d8c6381c0c7 Ref cert-portal.siemens.com/productcert/html/ssa-253495.html

Frequently Asked Questions

What is CVE-2026-23031?

CVE-2026-23031 is a known-severity vulnerability. It was published on January 31, 2026.

How severe is CVE-2026-23031?

CVSS score information is not yet available for this vulnerability. Check back as the CVE record is updated by NVD analysts.

How do I fix or remediate CVE-2026-23031?

How can CyberStrike help with CVE-2026-23031?

CyberStrike's AI-powered security agents can automatically detect CVE-2026-23031 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.