{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-23037 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-23037 is a memory corruption vulnerability in Linux, published on 31 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-23037 and fix it if it is affected.\n\nWhat it is: CVE-2026-23037 is a memory corruption vulnerability in Linux, published on 31 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-23037 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-23037/ (Markdown: https://insights.sbomify.com/CVE-2026-23037/index.md)","id":"CVE-2026-23037","markdown":"https://insights.sbomify.com/CVE-2026-23037/index.md","name":"CVE-2026-23037","record":{"aliases":["BELL-CVE-2026-23037","DEBIAN-CVE-2026-23037","GHSA-35c8-wvgc-32mg","ROOT-OS-DEBIAN-12-CVE-2026-23037","ROOT-OS-DEBIAN-13-CVE-2026-23037","ROOT-OS-UBUNTU-2204-CVE-2026-23037","ROOT-OS-UBUNTU-2404-CVE-2026-23037","UBUNTU-CVE-2026-23037"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel driver","requires_auth":"none","summary":"A memory leak in the Linux kernel CAN driver allows attackers to cause denial of service by triggering partial URB allocation failures.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncan: etas_es58x: allow partial RX URB allocation to succeed\n\nWhen es58x_alloc_rx_urbs() fails to allocate the requested number of\nURBs but succeeds in allocating some, it returns an error code.\nThis causes es58x_open() to return early, skipping the cleanup label\n'free_urbs', which leads to the anchored URBs being leaked.\n\nAs pointed out by maintainer Vincent Mailhol, the driver is designed\nto handle partial URB allocation gracefully. Therefore, partial\nallocation should not be treated as a fatal error.\n\nModify es58x_alloc_rx_urbs() to return 0 if at least one URB has been\nallocated, restoring the intended behavior and preventing the leak\nin es58x_open().","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"can: etas_es58x: allow partial RX URB allocation to succeed","id":"CVE-2026-23037","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"memory_corruption","year":"2026"},"n_packages":0,"n_references":6,"next":{"headline":"pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()","id":"CVE-2026-23038"},"packages":[],"prev":{"headline":"btrfs: release path before iget_failed() in btrfs_read_locked_inode()","id":"CVE-2026-23036"},"products":["Linux"],"published":"2026-01-31","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-06-02","vendors":["Linux"]},"summary":"A memory leak in the Linux kernel CAN driver allows attackers to cause denial of service by triggering partial URB allocation failures.","url":"https://insights.sbomify.com/CVE-2026-23037/"}