CVE-2026-23298

MediumCVSS 5.5/10Last modified Nov 5, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

can: ucan: Fix infinite loop from zero-length messages

If a broken ucan device gets a message with the message length field set to 0, then the driver will loop for forever in ucan_read_bulk_callback(), hanging the system. If the length is 0, just skip the message and go on to the next one.

This has been fixed in the kvaser_usb driver in the past in commit 0c73772cd2b8 ("can: kvaser_usb: leaf: Fix potential infinite loop in command parsers"), so there must be some broken devices out there like this somewhere.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-835

Affected software

VendorProductVersions
LinuxLinux>= 9f2d3eae88d26c29d96e42983b755940d9169cd9, < ca07d3c6eef14d34e6fdeefe55058db045be29dc; >= 9f2d3eae88d26c29d96e42983b755940d9169cd9, < e7bb6e0606b5f233531aaaad9542d69fbb792115; >= 9f2d3eae88d26c29d96e42983b755940d9169cd9, < ab6f075492d37368b4c7b0df7f7fdc2b666887fc; >= 9f2d3eae88d26c29d96e42983b755940d9169cd9, < 13b646eec3ba1131180803f5aaf1fee23540ad8f; >= 9f2d3eae88d26c29d96e42983b755940d9169cd9, < bd85f21a6219aeae4389d700c54f1799f4b814e0; >= 9f2d3eae88d26c29d96e42983b755940d9169cd9, < aa9e0a7fe5efc2f74327fd37d828e9a51d9ff588; >= 9f2d3eae88d26c29d96e42983b755940d9169cd9, < c7bc62be6c1a60bb21301692009590b1ffda91d9; >= 9f2d3eae88d26c29d96e42983b755940d9169cd9, < 1e446fd0582ad8be9f6dafb115fc2e7245f9bea7
LinuxLinux4.19

References

Timeline

Published
Mar 25, 2026
Last modified
Nov 5, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-232995.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: purge error queues in socket destructors When TX timestampiCVE-2026-23309.4An attacker may access restricted filesystem areas on the device via the CROWN REST interface due to incomplete whitelist enforcement. CertaCVE-2026-233005.5In the Linux kernel, the following vulnerability has been resolved: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop CVE-2026-233015.5In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Add allocation failure check for Entity name Currently finCVE-2026-233024.7In the Linux kernel, the following vulnerability has been resolved: net: annotate data-races around sk->sk_{data_ready,write_space} skmsg CVE-2026-233035.5In the Linux kernel, the following vulnerability has been resolved: smb: client: Don't log plaintext credentials in cifs_set_cifscreds WheCVE-2026-233045.5In the Linux kernel, the following vulnerability has been resolved: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() l3mdev_master_devCVE-2026-233057.1In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix unwinding in error path in rocket_probe When rocket_CVE-2026-233067.8In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix use-after-free in pm8001_queue_command() Commit e29cCVE-2026-233075.5In the Linux kernel, the following vulnerability has been resolved: can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of CVE-2026-233085.5In the Linux kernel, the following vulnerability has been resolved: pinctrl: equilibrium: fix warning trace on load The callback functionsCVE-2026-233095.5In the Linux kernel, the following vulnerability has been resolved: tracing: Add NULL pointer check to trigger_data_free() If trigger_data
CVE-2026-23298: Medium severity, CVSS 5.5 | Vulnix