CVE-2026-23298

Vulnerability

Description

In the Linux kernel's ucan CAN driver (drivers/net/can/usb/ucan.c), the ucan_read_bulk_callback() function processes incoming USB messages from a CAN device. If a device sends a message with the length field set to 0, the driver enters an infinite loop because it does not validate the length before processing. This bug is analogous to a previously fixed issue in the kvaser_usb driver (commit 0c73772cd2b8), indicating that similar broken devices exist in the field [1][2][3][4].

Exploitation

Conditions

An attacker must have a USB CAN device that can send crafted messages with a zero-length field. This could be achieved through physical access to the USB port or by compromising a legitimate device to inject malicious packets. No authentication is required; the driver implicitly trusts the message length provided by the device. The vulnerability is triggered when the driver receives such a message in the bulk callback, causing an infinite loop that consumes CPU resources.

Impact

Successful exploitation results in a denial of service (DoS) by hanging the entire system. The infinite loop prevents the CPU from executing other tasks, effectively freezing the machine. This can lead to loss of availability for any services running on the affected system.

Mitigation

The fix has been applied to the Linux kernel stable tree via commits [1][2][3][4]. Users should update to a kernel version that includes these commits. No workaround is documented; the driver must be patched to skip zero-length messages.