CVE-2026-46103 Details
Description
In the Linux kernel, the following vulnerability has been resolved: can: ucan: fix devres lifetime USB drivers bind to USB interfaces and any device managed resources should have their lifetime tied to the interface rather than parent USB device. This avoids issues like memory leaks when drivers are unbound without their devices being physically disconnected (e.g. on probe deferral or configuration changes). Fix the control message buffer lifetime so that it is released on driver unbind.
A vulnerability in the Linux kernel's USB driver management for UCAN devices can lead to memory leaks. This issue arises because the lifetime of resources managed by the driver is tied to the parent USB device instead of the USB interface. As a result, when drivers are unbound without the devices being physically disconnected, it can cause unmanaged memory to accumulate. The vulnerability has been addressed by modifying the control message buffer's lifetime management, ensuring it is properly released when the driver is unbound.
Users can upgrade to the patched version of the Linux kernel available in the Linux kernel stable tree.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/10b7b676b78a7bd888d19729b459aad7fc1f428b | kernel.org | Patch |
| https://git.kernel.org/stable/c/3df5b9110ac08f67ccfe382fc172bfee95688eec | kernel.org | Patch |
| https://git.kernel.org/stable/c/4b7d07747400cfd7eff1ba7b8b5a7c8d5a58f705 | kernel.org | Patch |
| https://git.kernel.org/stable/c/a90f0815aaa9c629ac4750e7c71c357dd7f231d7 | kernel.org | Patch |
| https://git.kernel.org/stable/c/c0d3ccc6929e4509076df8f30a4fb1dc5018b0ae | kernel.org | Patch |
| https://git.kernel.org/stable/c/c524c124e3094d2de12235a513854c03d06a2b58 | kernel.org | Patch |
| https://git.kernel.org/stable/c/cb2e41e87a2893345859440017e7178bf7a4c70d | kernel.org | Patch |
| https://git.kernel.org/stable/c/fed4626501c871890da287bec62a96e52da1af89 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-401 | Missing Release of Memory after Effective Lifetime | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 4.19, < 5.10.259 >= 5.11, < 5.15.210 >= 5.16, < 6.1.175 >= 6.2, < 6.6.140 >= 6.7, < 6.12.86 >= 6.13, < 6.18.27 >= 6.19, < 7.0.4 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | Initial Analysis | [email protected] |
| Jun 19, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 1, 2026 | CVE Modified | kernel.org |
| May 27, 2026 | New CVE Received | kernel.org |