CVE-2026-23307

Vulnerability

In the Linux kernel's CAN subsystem, the ems_usb driver, the function ems_usb_read_bulk_callback() incorrectly used transfer_buffer_length (the maximum buffer size set by the driver) instead of actual_length` (the actual data size received from the USB device) when parsing incoming messages. This mismatch means the driver could attempt to read beyond the valid data in the USB URB, leading to an out-of-bounds read [1][2].

Exploitation

An attacker with physical access to the system or the ability to connect a malicious USB device could send crafted CAN messages that exploit this length validation flaw. No special privileges beyond the ability to interact with the CAN interface are required, as the vulnerability lies in the kernel's handling of data from a USB device that is already trusted by the kernel [3].

Impact

Successful exploitation could allow an attacker to read sensitive kernel memory or cause a denial of service (system crash) by triggering an out-of-bounds access. The vulnerability does not directly enable arbitrary code execution, but memory corruption may be leveraged for further attacks [4].

Mitigation

Patches have been committed to the Linux kernel stable tree. Users should update to a kernel version containing the fix, which adds proper length checks using actual_length at both the start and end of message parsing [1][2][3][4].