CVE-2026-22997

Vulnerability

Description

In the Linux kernel's J1939 protocol implementation, a refcount leak occurs in j1939_xtp_rx_rts_session_active() when a second RTS (Request to Send) frame is received. The leak happens because j1939_session_deactivate_activate_next() is only called when the timer is enabled, but if the timer is cancelled, the session is not properly deactivated, leading to an elevated reference count.

Attack

Surface

This vulnerability can be exploited by an attacker with local access and the ability to send raw CAN frames over a J1939 interface. No authentication is required, only the ability to communicate via the CAN bus. The attacker sends a first RTS frame to create a session, then sends a second RTS frame to trigger the leak without proper session deactivation.

Impact

The refcount leak prevents the session object from being freed, eventually causing the kernel to hang when unregistering the network device. This results in a denial-of-service (DoS) condition, as the system waits indefinitely for the device usage count to drop to zero, as indicated by the kernel message 'unregister_netdevice: waiting for vcan0 to become free. Usage count = 2.' [1][2][3]

Mitigation

The fix involves calling j1939_session_deactivate_activate_next() when the timer is cancelled, ensuring the session is deactivated and the refcount is properly released. The patch is available in the stable kernel tree and has been backported to affected versions. Users are advised to apply the latest kernel updates to remediate this vulnerability.