CVE-2026-23307: can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message
can: emsusb: emsusbreadbulkcallback(): check the proper length of a message
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23307?
CVE-2026-23307 is classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2026-23307?
To fix CVE-2026-23307, ensure you update to the latest version of the Linux kernel where this vulnerability has been patched.
What systems are affected by CVE-2026-23307?
CVE-2026-23307 affects various versions of the Linux kernel, particularly those using the EMS USB interface for CAN communications.
What type of vulnerability is CVE-2026-23307?
CVE-2026-23307 is a vulnerability in the handling of USB CAN messages that can lead to improper message length checks.
Is CVE-2026-23307 exploitable remotely?
CVE-2026-23307 does not appear to be directly exploitable remotely, but it can be a risk if the vulnerable component is accessible.