PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-22997 Linux CVE debrief

A high-severity vulnerability (CVSS 7.5) exists in the Linux kernel's CAN J1939 protocol implementation. The vulnerability, tracked as CVE-2026-22997, is caused by a use-after-free condition that can occur when receiving a second RTS (Request to Send) message for an active session. This can lead to a reference count leak for the j1939_session, which may cause issues with network device unregistration. The vulnerability affects various Linux kernel versions, including 5.4, 5.11, 5.16, 6.2, 6.7, and 6.13. Linux kernel maintainers have addressed this issue with a series of patches.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-01-25
Original CVE updated
2026-06-17
Advisory published
2026-01-25
Advisory updated
2026-06-17

Who should care

System administrators and security teams responsible for Linux-based systems, especially those using CAN (Controller Area Network) J1939 protocol, should be aware of this vulnerability. This includes industries that rely on Linux-based devices for automotive, industrial automation, and other applications where CAN J1939 is used.

Technical summary

The vulnerability is located in the j1939_xtp_rx_rts_session_active() function of the Linux kernel's CAN J1939 protocol implementation. When a second RTS message is received for an active session, the session is not properly deactivated, leading to a use-after-free condition. This can cause a reference count leak for the j1939_session, potentially resulting in issues such as network device unregistration failures.

Defensive priority

High

Recommended defensive actions

  • Apply the patches provided by Linux kernel maintainers to address the vulnerability.
  • Update Linux kernel to a version that includes the fixes, such as 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.67, or later.
  • Implement additional monitoring and logging to detect potential exploitation attempts.
  • Restrict access to CAN J1939 protocol interfaces to minimize the attack surface.
  • Consider implementing a Web Application Firewall (WAF) or network traffic filtering to detect and block suspicious traffic.

Evidence notes

The information provided is based on the CVE-2026-22997 record and related patches from the Linux kernel repository. The vulnerability has been addressed by Linux kernel maintainers with a series of patches.

Official resources

public