CVE-2026-43223 Details
Description
In the Linux kernel, the following vulnerability has been resolved: media: pvrusb2: fix URB leak in pvr2_send_request_ex When pvr2_send_request_ex() submits a write URB successfully but fails to submit the read URB (e.g. returns -ENOMEM), it returns immediately without waiting for the write URB to complete. Since the driver reuses the same URB structure, a subsequent call to pvr2_send_request_ex() attempts to submit the still-active write URB, triggering a 'URB submitted while active' warning in usb_submit_urb(). Fix this by ensuring the write URB is unlinked and waited upon if the read URB submission fails.
A vulnerability has been identified in the Linux kernel's PVRUSB2 media driver, specifically in the function 'pvr2_send_request_ex'. When this function successfully submits a write USB Request Block (URB) but fails to submit the corresponding read URB—such as when it returns an 'out of memory' error—it immediately exits without waiting for the write URB to finish. This behavior can lead to a URB leak, as the driver reuses the same URB structure. Consequently, a later call to 'pvr2_send_request_ex' may try to submit a write URB that is still active, causing a warning about a 'URB submitted while active' in 'usb_submit_urb'. The vulnerability arises because the driver does not properly manage the lifecycle of the URBs when an error occurs during the read URB submission.
The vulnerability has been fixed in the Linux kernel. Users should upgrade to the latest version where this issue has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/2011929f0e4cf6a0a34dd6205911b12276904453 | kernel.org | Patch |
| https://git.kernel.org/stable/c/4ba5c7a1aade7090172cbffd4d120bf4cf5ccbde | kernel.org | Patch |
| https://git.kernel.org/stable/c/58dd722b6c3debcddb4684fb256c90fee7f063e5 | kernel.org | Patch |
| https://git.kernel.org/stable/c/5f3ac816861c3b8a5d1a3645b17dc3a99d668d94 | kernel.org | Patch |
| https://git.kernel.org/stable/c/77a63f8efc434ddb04667ed632aade58301a2f13 | kernel.org | Patch |
| https://git.kernel.org/stable/c/a8333c8262aed2aedf608c18edd39cf5342680a7 | kernel.org | Patch |
| https://git.kernel.org/stable/c/cf459d6ffa5e150ef3744b897f936ff24b52bd15 | kernel.org | Patch |
| https://git.kernel.org/stable/c/da524c939b1e5ba17f10db4bde4bdaf569ffcda6 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-401 | Missing Release of Memory after Effective Lifetime | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 2.6.18, < 5.10.252 >= 5.11, < 5.15.202 >= 5.16, < 6.1.165 >= 6.2, < 6.6.128 >= 6.7, < 6.12.75 >= 6.13, < 6.18.16 >= 6.19, < 6.19.6 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| May 8, 2026 | Initial Analysis | [email protected] |
| May 6, 2026 | New CVE Received | kernel.org |