PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-23307 Linux CVE debrief

A vulnerability in the Linux kernel's EMS USB CAN driver (ems_usb) could allow a local attacker to cause a denial of service. The issue exists in the ems_usb_read_bulk_callback() function, which incorrectly uses transfer_buffer_length (the maximum buffer size set by the driver) instead of actual_length (the actual data size received) when parsing USB urb data. This leads to improper bounds checking at both the beginning and end of message parsing, potentially causing buffer overreads. The vulnerability affects Linux kernel versions from 2.6.32 through 6.19.7, as well as 7.0-rc1 and 7.0-rc2. Patches are available for all affected stable kernel branches.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-25
Original CVE updated
2026-05-28
Advisory published
2026-03-25
Advisory updated
2026-05-28

Who should care

Organizations running Linux systems with EMS USB CAN bus interfaces, particularly in industrial control, automotive, and embedded systems environments. System administrators maintaining Linux kernels prior to the patched versions in affected branches.

Technical summary

The ems_usb_read_bulk_callback() function in drivers/net/can/usb/ems_usb.c incorrectly validates message lengths using transfer_buffer_length rather than actual_length from the USB urb structure. This causes the parser to potentially read beyond the actual received data when processing multiple messages in a bulk transfer. The fix adds proper bounds checking at both message start (ensuring sufficient data for the expected structure) and message end (preventing overflow into subsequent messages).

Defensive priority

medium

Recommended defensive actions

  • Apply the appropriate kernel patch for your Linux distribution's stable branch: 5.10.253+, 5.15.203+, 6.1.167+, 6.6.130+, 6.12.77+, 6.18.17+, 6.19.7+, or later versions
  • Update to a patched kernel version provided by your Linux distribution vendor
  • If immediate patching is not possible, consider restricting physical access to systems with EMS USB CAN devices attached, as the attack requires local access
  • Monitor kernel logs for unusual activity related to USB CAN device operations

Evidence notes

The vulnerability description is sourced from the official CVE record and NVD entry. The issue was resolved by correcting the length check in ems_usb_read_bulk_callback() to use actual_length instead of transfer_buffer_length. Multiple kernel stable branch patches are available.

Official resources

2026-03-25