---
id: CVE-2026-43223
title: 'media: pvrusb2: fix URB leak in pvr2_send_request_ex'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  media: pvrusb2: fix URB leak in pvr2_send_request_ex

  When pvr2_send_request_ex() submits a write URB successfully but fails to
  submit the read URB (e.g. returns -ENOME…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d855497edbfbf9e19a17f4a1154bca69cb4bd9ba <
    da524c939b1e5ba17f10db4bde4bdaf569ffcda6
  - >-
    Linux >= d855497edbfbf9e19a17f4a1154bca69cb4bd9ba <
    cf459d6ffa5e150ef3744b897f936ff24b52bd15
  - >-
    Linux >= d855497edbfbf9e19a17f4a1154bca69cb4bd9ba <
    77a63f8efc434ddb04667ed632aade58301a2f13
  - >-
    Linux >= d855497edbfbf9e19a17f4a1154bca69cb4bd9ba <
    4ba5c7a1aade7090172cbffd4d120bf4cf5ccbde
  - >-
    Linux >= d855497edbfbf9e19a17f4a1154bca69cb4bd9ba <
    58dd722b6c3debcddb4684fb256c90fee7f063e5
  - >-
    Linux >= d855497edbfbf9e19a17f4a1154bca69cb4bd9ba <
    2011929f0e4cf6a0a34dd6205911b12276904453
  - >-
    Linux >= d855497edbfbf9e19a17f4a1154bca69cb4bd9ba <
    5f3ac816861c3b8a5d1a3645b17dc3a99d668d94
  - >-
    Linux >= d855497edbfbf9e19a17f4a1154bca69cb4bd9ba <
    a8333c8262aed2aedf608c18edd39cf5342680a7
  - Linux 2.6.18
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T15:30:51.559171Z'
published: '2026-05-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:32:36.499Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43223'
references:
  - url: 'https://git.kernel.org/stable/c/da524c939b1e5ba17f10db4bde4bdaf569ffcda6'
  - url: 'https://git.kernel.org/stable/c/cf459d6ffa5e150ef3744b897f936ff24b52bd15'
  - url: 'https://git.kernel.org/stable/c/77a63f8efc434ddb04667ed632aade58301a2f13'
  - url: 'https://git.kernel.org/stable/c/4ba5c7a1aade7090172cbffd4d120bf4cf5ccbde'
  - url: 'https://git.kernel.org/stable/c/58dd722b6c3debcddb4684fb256c90fee7f063e5'
  - url: 'https://git.kernel.org/stable/c/2011929f0e4cf6a0a34dd6205911b12276904453'
  - url: 'https://git.kernel.org/stable/c/5f3ac816861c3b8a5d1a3645b17dc3a99d668d94'
  - url: 'https://git.kernel.org/stable/c/a8333c8262aed2aedf608c18edd39cf5342680a7'
tags:
  - cve.org
epss: 0.00128
epssPercentile: 0.02476
ingestedAt: '2026-11-06T15:54:04.007Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

media: pvrusb2: fix URB leak in pvr2_send_request_ex

When pvr2_send_request_ex() submits a write URB successfully but fails to
submit the read URB (e.g. returns -ENOMEM), it returns immediately without
waiting for the write URB to complete. Since the driver reuses the same
URB structure, a subsequent call to pvr2_send_request_ex() attempts to
submit the still-active write URB, triggering a 'URB submitted while
active' warning in usb_submit_urb().

Fix this by ensuring the write URB is unlinked and waited upon if the read
URB submission fails.

## Affected

- `Linux >= d855497edbfbf9e19a17f4a1154bca69cb4bd9ba < da524c939b1e5ba17f10db4bde4bdaf569ffcda6`
- `Linux >= d855497edbfbf9e19a17f4a1154bca69cb4bd9ba < cf459d6ffa5e150ef3744b897f936ff24b52bd15`
- `Linux >= d855497edbfbf9e19a17f4a1154bca69cb4bd9ba < 77a63f8efc434ddb04667ed632aade58301a2f13`
- `Linux >= d855497edbfbf9e19a17f4a1154bca69cb4bd9ba < 4ba5c7a1aade7090172cbffd4d120bf4cf5ccbde`
- `Linux >= d855497edbfbf9e19a17f4a1154bca69cb4bd9ba < 58dd722b6c3debcddb4684fb256c90fee7f063e5`
- `Linux >= d855497edbfbf9e19a17f4a1154bca69cb4bd9ba < 2011929f0e4cf6a0a34dd6205911b12276904453`
- `Linux >= d855497edbfbf9e19a17f4a1154bca69cb4bd9ba < 5f3ac816861c3b8a5d1a3645b17dc3a99d668d94`
- `Linux >= d855497edbfbf9e19a17f4a1154bca69cb4bd9ba < a8333c8262aed2aedf608c18edd39cf5342680a7`
- `Linux 2.6.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.