{"id":"CVE-2026-43223","title":"media: pvrusb2: fix URB leak in pvr2_send_request_ex","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: pvrusb2: fix URB leak in pvr2_send_request_ex\n\nWhen pvr2_send_request_ex() submits a write URB successfully but fails to\nsubmit the read URB (e.g. returns -ENOME…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= d855497edbfbf9e19a17f4a1154bca69cb4bd9ba < da524c939b1e5ba17f10db4bde4bdaf569ffcda6","Linux >= d855497edbfbf9e19a17f4a1154bca69cb4bd9ba < cf459d6ffa5e150ef3744b897f936ff24b52bd15","Linux >= d855497edbfbf9e19a17f4a1154bca69cb4bd9ba < 77a63f8efc434ddb04667ed632aade58301a2f13","Linux >= d855497edbfbf9e19a17f4a1154bca69cb4bd9ba < 4ba5c7a1aade7090172cbffd4d120bf4cf5ccbde","Linux >= d855497edbfbf9e19a17f4a1154bca69cb4bd9ba < 58dd722b6c3debcddb4684fb256c90fee7f063e5","Linux >= d855497edbfbf9e19a17f4a1154bca69cb4bd9ba < 2011929f0e4cf6a0a34dd6205911b12276904453","Linux >= d855497edbfbf9e19a17f4a1154bca69cb4bd9ba < 5f3ac816861c3b8a5d1a3645b17dc3a99d668d94","Linux >= d855497edbfbf9e19a17f4a1154bca69cb4bd9ba < a8333c8262aed2aedf608c18edd39cf5342680a7","Linux 2.6.18"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T15:30:51.559171Z"},"published":"2026-05-06","updated":"2026-11-06","sourceUpdated":"2026-11-06T15:32:36.499Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43223","references":[{"url":"https://git.kernel.org/stable/c/da524c939b1e5ba17f10db4bde4bdaf569ffcda6"},{"url":"https://git.kernel.org/stable/c/cf459d6ffa5e150ef3744b897f936ff24b52bd15"},{"url":"https://git.kernel.org/stable/c/77a63f8efc434ddb04667ed632aade58301a2f13"},{"url":"https://git.kernel.org/stable/c/4ba5c7a1aade7090172cbffd4d120bf4cf5ccbde"},{"url":"https://git.kernel.org/stable/c/58dd722b6c3debcddb4684fb256c90fee7f063e5"},{"url":"https://git.kernel.org/stable/c/2011929f0e4cf6a0a34dd6205911b12276904453"},{"url":"https://git.kernel.org/stable/c/5f3ac816861c3b8a5d1a3645b17dc3a99d668d94"},{"url":"https://git.kernel.org/stable/c/a8333c8262aed2aedf608c18edd39cf5342680a7"}],"tags":["cve.org"],"epss":0.00128,"epssPercentile":0.02476,"ingestedAt":"2026-11-06T15:54:04.007Z","slug":"CVE-2026-43223","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmedia: pvrusb2: fix URB leak in pvr2_send_request_ex\n\nWhen pvr2_send_request_ex() submits a write URB successfully but fails to\nsubmit the read URB (e.g. returns -ENOMEM), it returns immediately without\nwaiting for the write URB to complete. Since the driver reuses the same\nURB structure, a subsequent call to pvr2_send_request_ex() attempts to\nsubmit the still-active write URB, triggering a 'URB submitted while\nactive' warning in usb_submit_urb().\n\nFix this by ensuring the write URB is unlinked and waited upon if the read\nURB submission fails.\n\n## Affected\n\n- `Linux >= d855497edbfbf9e19a17f4a1154bca69cb4bd9ba < da524c939b1e5ba17f10db4bde4bdaf569ffcda6`\n- `Linux >= d855497edbfbf9e19a17f4a1154bca69cb4bd9ba < cf459d6ffa5e150ef3744b897f936ff24b52bd15`\n- `Linux >= d855497edbfbf9e19a17f4a1154bca69cb4bd9ba < 77a63f8efc434ddb04667ed632aade58301a2f13`\n- `Linux >= d855497edbfbf9e19a17f4a1154bca69cb4bd9ba < 4ba5c7a1aade7090172cbffd4d120bf4cf5ccbde`\n- `Linux >= d855497edbfbf9e19a17f4a1154bca69cb4bd9ba < 58dd722b6c3debcddb4684fb256c90fee7f063e5`\n- `Linux >= d855497edbfbf9e19a17f4a1154bca69cb4bd9ba < 2011929f0e4cf6a0a34dd6205911b12276904453`\n- `Linux >= d855497edbfbf9e19a17f4a1154bca69cb4bd9ba < 5f3ac816861c3b8a5d1a3645b17dc3a99d668d94`\n- `Linux >= d855497edbfbf9e19a17f4a1154bca69cb4bd9ba < a8333c8262aed2aedf608c18edd39cf5342680a7`\n- `Linux 2.6.18`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}