PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-23307 Linux CVE debrief

A vulnerability in the Linux kernel's EMS USB CAN driver (ems_usb) could allow a local attacker to cause a denial of service. The issue exists in the ems_usb_read_bulk_callback() function, which incorrectly uses transfer_buffer_length (the maximum buffer size set by the driver) instead of actual_length (the actual data size received) when parsing USB urb data. This leads to improper bounds checking at both the beginning and end of message parsing, potentially causing buffer overreads. The vulnerability affects Linux kernel versions from 2.6.32 through 6.19.7, as well as 7.0-rc1 and 7.0-rc2. Patches are available for all affected stable kernel branches.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-25
Original CVE updated
2026-05-28
Advisory published
2026-03-25
Advisory updated
2026-05-28

Who should care

Organizations running Linux systems with EMS USB CAN bus interfaces, particularly in industrial control, automotive, and embedded systems environments. System administrators maintaining Linux kernels prior to the patched versions in affected branches.

Technical summary

The ems_usb_read_bulk_callback() function in drivers/net/can/usb/ems_usb.c incorrectly validates message lengths using transfer_buffer_length rather than actual_length from the USB urb structure. This causes the parser to potentially read beyond the actual received data when processing multiple messages in a bulk transfer. The fix adds proper bounds checking at both message start (ensuring sufficient data for the expected structure) and message end (preventing overflow into subsequent messages).

Defensive priority

medium

Recommended defensive actions

  • Apply the appropriate kernel patch for your Linux distribution's stable branch: 5.10.253+, 5.15.203+, 6.1.167+, 6.6.130+, 6.12.77+, 6.18.17+, 6.19.7+, or later versions
  • Update to a patched kernel version provided by your Linux distribution vendor
  • If immediate patching is not possible, consider restricting physical access to systems with EMS USB CAN devices attached, as the attack requires local access
  • Monitor kernel logs for unusual activity related to USB CAN device operations

Evidence notes

The vulnerability description is sourced from the official CVE record and NVD entry. The issue was resolved by correcting the length check in ems_usb_read_bulk_callback() to use actual_length instead of transfer_buffer_length. Multiple kernel stable branch patches are available.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-23307 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-23307

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-23307 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-23307

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1818974e1b5ef200e27f144c8cb8a246420bb54d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/18f75b9cbdc3703f15965425ab69dee509b07785

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1cf469026d4a2308eaa91d04dca4a900d07a5c2e

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/2833e13e2b099546abf5d40a483b4eb04ddd1f7b

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/38a01c9700b0dcafe97dfa9dc7531bf4a245deff

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/aed172a2e2330131f0977d2acd3ec8883f413ec1

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c703bbf8e9b4947e111c88d2ed09236a6772a471

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.