CVE-2026-23357: can: mcp251x: fix deadlock in error path of mcp251x_open
can: mcp251x: fix deadlock in error path of mcp251xopen
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.130.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In the mcp251x_open() error path, set priv->force_quit = 1 before freeing the IRQ, release the mpc_lock mutex, and then call free_irq() so the interrupt handler can exit without deadlocking.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel mcp251x CAN driver are affected. The listed software also includes Microsoft azl3 kernel 6.6.126.1-1.
What conditions are required to trigger the deadlock?
The mcp251x_open() error path must call free_irq() while holding the mpc_lock mutex, after an interrupt has already occurred. The interrupt handler then waits for mpc_lock while free_irq() waits for that handler to finish.
What is the operational impact if the issue is triggered?
The affected open error path can deadlock, preventing the involved execution from completing. The reported impact is availability only; no confidentiality or integrity impact is specified.
Is a fix available?
Yes. A patch is available that releases the lock before calling free_irq() and sets force_quit so the IRQ handler exits once it obtains the lock.