CVE-2026-23298
Infinite Loop Vulnerability in Linux Kernel UCAN Driver
Publication date: 2026-03-25
Last updated on: 2026-04-18
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| kvaser | kvaser_usb | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's ucan driver. When the driver receives a message with a length field set to zero from a broken ucan device, it enters an infinite loop inside the ucan_read_bulk_callback() function. This causes the system to hang because the driver continuously processes the zero-length message without progressing.
The issue has been fixed by modifying the driver to skip any messages with a zero length instead of processing them, preventing the infinite loop.
How can this vulnerability impact me? :
If exploited, this vulnerability can cause the affected system to hang or become unresponsive due to the infinite loop triggered by zero-length messages from broken ucan devices. This can lead to denial of service conditions, potentially disrupting normal operations.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is caused by the ucan driver entering an infinite loop when receiving zero-length messages from broken ucan devices. To mitigate this, ensure your Linux kernel is updated with the fix that skips zero-length messages in ucan_read_bulk_callback().
If updating the kernel is not immediately possible, avoid using or disconnect any known broken ucan devices that might send zero-length messages, as these can cause the system to hang.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability occurs when a broken ucan device receives a message with a zero-length message field, causing the driver to enter an infinite loop and hang the system.
To detect this vulnerability on your system, you can monitor the behavior of the kvaser_usb driver and check for system hangs or unusual CPU usage related to ucan devices.
Since the issue is triggered by zero-length messages, you can attempt to capture CAN traffic and inspect message lengths to identify any zero-length messages being sent.
- Use the 'candump' tool from the can-utils package to capture CAN messages: candump can0
- Filter captured messages to check for zero-length frames, for example by parsing candump output or using custom scripts.
- Monitor system logs (e.g., dmesg or journalctl) for any kernel messages or errors related to the kvaser_usb driver.
- Check for system hangs or high CPU usage in processes related to CAN device drivers.