{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46103", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-13T15:03:33.097Z", "datePublished": "2026-05-27T12:59:11.533Z", "dateUpdated": "2026-06-19T11:59:29.306Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-06-19T11:59:29.306Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: ucan: fix devres lifetime\n\nUSB drivers bind to USB interfaces and any device managed resources\nshould have their lifetime tied to the interface rather than parent USB\ndevice. This avoids issues like memory leaks when drivers are unbound\nwithout their devices being physically disconnected (e.g. on probe\ndeferral or configuration changes).\n\nFix the control message buffer lifetime so that it is released on driver\nunbind."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/can/usb/ucan.c"], "versions": [{"version": "9f2d3eae88d26c29d96e42983b755940d9169cd9", "lessThan": "a90f0815aaa9c629ac4750e7c71c357dd7f231d7", "status": "affected", "versionType": "git"}, {"version": "9f2d3eae88d26c29d96e42983b755940d9169cd9", "lessThan": "cb2e41e87a2893345859440017e7178bf7a4c70d", "status": "affected", "versionType": "git"}, {"version": "9f2d3eae88d26c29d96e42983b755940d9169cd9", "lessThan": "3df5b9110ac08f67ccfe382fc172bfee95688eec", "status": "affected", "versionType": "git"}, {"version": "9f2d3eae88d26c29d96e42983b755940d9169cd9", "lessThan": "4b7d07747400cfd7eff1ba7b8b5a7c8d5a58f705", "status": "affected", "versionType": "git"}, {"version": "9f2d3eae88d26c29d96e42983b755940d9169cd9", "lessThan": "10b7b676b78a7bd888d19729b459aad7fc1f428b", "status": "affected", "versionType": "git"}, {"version": "9f2d3eae88d26c29d96e42983b755940d9169cd9", "lessThan": "c524c124e3094d2de12235a513854c03d06a2b58", "status": "affected", "versionType": "git"}, {"version": "9f2d3eae88d26c29d96e42983b755940d9169cd9", "lessThan": "c0d3ccc6929e4509076df8f30a4fb1dc5018b0ae", "status": "affected", "versionType": "git"}, {"version": "9f2d3eae88d26c29d96e42983b755940d9169cd9", "lessThan": "fed4626501c871890da287bec62a96e52da1af89", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/can/usb/ucan.c"], "versions": [{"version": "4.19", "status": "affected"}, {"version": "0", "lessThan": "4.19", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.259", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.210", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.140", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.86", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.27", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.4", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.10.259"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.15.210"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.6.140"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.12.86"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.18.27"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "7.0.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a90f0815aaa9c629ac4750e7c71c357dd7f231d7"}, {"url": "https://git.kernel.org/stable/c/cb2e41e87a2893345859440017e7178bf7a4c70d"}, {"url": "https://git.kernel.org/stable/c/3df5b9110ac08f67ccfe382fc172bfee95688eec"}, {"url": "https://git.kernel.org/stable/c/4b7d07747400cfd7eff1ba7b8b5a7c8d5a58f705"}, {"url": "https://git.kernel.org/stable/c/10b7b676b78a7bd888d19729b459aad7fc1f428b"}, {"url": "https://git.kernel.org/stable/c/c524c124e3094d2de12235a513854c03d06a2b58"}, {"url": "https://git.kernel.org/stable/c/c0d3ccc6929e4509076df8f30a4fb1dc5018b0ae"}, {"url": "https://git.kernel.org/stable/c/fed4626501c871890da287bec62a96e52da1af89"}], "title": "can: ucan: fix devres lifetime", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/can/usb/ucan.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3df5b9110ac08f67ccfe382fc172bfee95688eec", "status": "affected", "version": "9f2d3eae88d26c29d96e42983b755940d9169cd9", "versionType": "git"}, {"lessThan": "4b7d07747400cfd7eff1ba7b8b5a7c8d5a58f705", "status": "affected", "version": "9f2d3eae88d26c29d96e42983b755940d9169cd9", "versionType": "git"}, {"lessThan": "10b7b676b78a7bd888d19729b459aad7fc1f428b", "status": "affected", "version": "9f2d3eae88d26c29d96e42983b755940d9169cd9", "versionType": "git"}, {"lessThan": "c524c124e3094d2de12235a513854c03d06a2b58", "status": "affected", "version": "9f2d3eae88d26c29d96e42983b755940d9169cd9", "versionType": "git"}, {"lessThan": "c0d3ccc6929e4509076df8f30a4fb1dc5018b0ae", "status": "affected", "version": "9f2d3eae88d26c29d96e42983b755940d9169cd9", "versionType": "git"}, {"lessThan": "fed4626501c871890da287bec62a96e52da1af89", "status": "affected", "version": "9f2d3eae88d26c29d96e42983b755940d9169cd9", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/can/usb/ucan.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.19"}, {"lessThan": "4.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.175", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.140", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.86", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.27", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: ucan: fix devres lifetime\n\nUSB drivers bind to USB interfaces and any device managed resources\nshould have their lifetime tied to the interface rather than parent USB\ndevice. This avoids issues like memory leaks when drivers are unbound\nwithout their devices being physically disconnected (e.g. on probe\ndeferral or configuration changes).\n\nFix the control message buffer lifetime so that it is released on driver\nunbind."}], "id": "CVE-2026-46103", "lastModified": "2026-06-17T10:53:04.307", "metrics": {}, "published": "2026-05-27T14:17:32.457", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/10b7b676b78a7bd888d19729b459aad7fc1f428b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3df5b9110ac08f67ccfe382fc172bfee95688eec"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4b7d07747400cfd7eff1ba7b8b5a7c8d5a58f705"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c0d3ccc6929e4509076df8f30a4fb1dc5018b0ae"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c524c124e3094d2de12235a513854c03d06a2b58"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fed4626501c871890da287bec62a96e52da1af89"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Awaiting Analysis"}

{"bugzilla": {"description": "kernel: can: ucan: fix devres lifetime", "id": "2482063", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482063"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["A flaw was found in the Linux kernel's `can: ucan` USB driver. This vulnerability arises from incorrect management of device resource lifetimes, where resources are tied to the parent USB device instead of the USB interface. This can lead to memory leaks when drivers are unbound without the associated devices being physically disconnected, such as during probe deferral or configuration changes. The primary consequence is a memory leak, which could potentially impact system stability or performance over time."], "name": "CVE-2026-46103", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-46103\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-46103\nhttps://lore.kernel.org/linux-cve-announce/2026052705-CVE-2026-46103-9028@gregkh/T"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9f2d3eae88d26c29d96e42983b755940d9169cd9,4b7d07747400cfd7eff1ba7b8b5a7c8d5a58f705)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9f2d3eae88d26c29d96e42983b755940d9169cd9,10b7b676b78a7bd888d19729b459aad7fc1f428b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9f2d3eae88d26c29d96e42983b755940d9169cd9,c524c124e3094d2de12235a513854c03d06a2b58)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9f2d3eae88d26c29d96e42983b755940d9169cd9,c0d3ccc6929e4509076df8f30a4fb1dc5018b0ae)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9f2d3eae88d26c29d96e42983b755940d9169cd9,fed4626501c871890da287bec62a96e52da1af89)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.140,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.86,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.27,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.4,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-27T18:00:15.746315+00:00", "title": "Fix for Resource Lifetime Mismanagement in Linux USB Drivers", "updated": "2026-05-28T02:45:05.158285+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-229", "CWE-772"]}