In the Linux kernel, the following vulnerability has been resolved:

can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure

es58x_read_bulk_callback() resubmits the RX URB after processing a received
packet. If the resubmit succeeds, the URB remains anchored and will be
handled by the normal RX path or by teardown.

However, if usb_submit_urb() fails, the callback unanchors the URB and then
returns directly. This skips the existing free_urb path, so the coherent
transfer buffer allocated with usb_alloc_coherent() is not released.

Reuse the existing free_urb path after a resubmit failure so that the RX
coherent buffer is freed before leaving the callback.

https://git.kernel.org/stable/c/0ef136ba052101243ba117a1aca6f4a4c3a81142

https://git.kernel.org/stable/c/19c6c8c6cd5dd14fab5fcd744584812a57cbb78d

https://git.kernel.org/stable/c/7a0cf2b2497c757c3cb1286eddf2986abb0d387b

https://git.kernel.org/stable/c/b85e5c310382803d27adf6fe6554d4208bc8951c

https://git.kernel.org/stable/c/c311f17c261fd375ddf5755f2ebe1f022c19c5b0

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/can/usb/etas_es58x/es58x_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f6e90c113c92e83fc0963d5e60e16b0e8a268981","lessThan":"0ef136ba052101243ba117a1aca6f4a4c3a81142","versionType":"git","status":"affected"},{"version":"b878444519fa03a3edd287d1963cf79ef78be2f1","lessThan":"b85e5c310382803d27adf6fe6554d4208bc8951c","versionType":"git","status":"affected"},{"version":"18eee279e9b5bff0db1aca9475ae4bc12804f05c","lessThan":"c311f17c261fd375ddf5755f2ebe1f022c19c5b0","versionType":"git","status":"affected"},{"version":"5eaad4f768266f1f17e01232ffe2ef009f8129b7","lessThan":"19c6c8c6cd5dd14fab5fcd744584812a57cbb78d","versionType":"git","status":"affected"},{"version":"5eaad4f768266f1f17e01232ffe2ef009f8129b7","lessThan":"7a0cf2b2497c757c3cb1286eddf2986abb0d387b","versionType":"git","status":"affected"},{"version":"7a0171b4921ad443fee5ed4fcb9d99fa4776edac","versionType":"git","status":"affected"},{"version":"2185ea6e4ebcb61d1224dc7d187c59723cb5ad59","versionType":"git","status":"affected"},{"version":"b8f9ca88253574638bcff38900a4c28d570b1919","versionType":"git","status":"affected"},{"version":"6.6.130","lessThan":"6.6.151","versionType":"semver","status":"affected"},{"version":"6.12.77","lessThan":"6.12.103","versionType":"semver","status":"affected"},{"version":"6.18.17","lessThan":"6.18.44","versionType":"semver","status":"affected"},{"version":"5.15.203","lessThan":"5.16","versionType":"semver","status":"affected"},{"version":"6.1.167","lessThan":"6.2","versionType":"semver","status":"affected"},{"version":"6.19.7","lessThan":"6.20","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/can/usb/etas_es58x/es58x_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.0","status":"affected"},{"version":"0","lessThan":"7.0","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc6","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]