CVE-2026-23298: can: ucan: Fix infinite loop from zero-length messages
can: ucan: Fix infinite loop from zero-length messages
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Upgrade
Upgrade
Linux kernel kvaser_usb driverto a version that resolves this vulnerability.Patch 0c73772cd2b8
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
Systems using the Linux kernel ucan CAN driver are exposed when a broken ucan device can deliver a message whose length field is zero. The affected software list also includes Microsoft azl3 kernel 6.6.126.1-1.
What does an attacker or triggering condition need to cause the denial of service?
The vulnerable driver must receive a message from a ucan device with its message length field set to 0. Processing that message can cause ucan_read_bulk_callback() to loop indefinitely and hang the system.
What can be done if patching cannot happen immediately?
Avoid using or connecting broken ucan devices that may send zero-length messages, since receiving such a message is the stated trigger. A patch is available.