CVE-2026-23357
Deadlock Vulnerability in Linux Kernel MCP251x CAN Driver
Publication date: 2026-03-25
Last updated on: 2026-04-24
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 2.6.34 |
| linux | linux_kernel | From 6.19 (inc) to 6.19.7 (exc) |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 6.13 (inc) to 6.18.17 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.130 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.77 (exc) |
| linux | linux_kernel | From 5.11 (inc) to 5.15.203 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.167 (exc) |
| linux | linux_kernel | From 2.6.34.1 (inc) to 5.10.253 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-667 | The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's mcp251x driver, specifically in the mcp251x_open() function. The issue occurs because free_irq() is called while holding the mpc_lock mutex. If an interrupt happens at the same time, the interrupt handler waits for the mpc_lock, and free_irq() waits for the interrupt handler to finish, causing a deadlock.
The problem is similar to a previously fixed issue but affects the error path of mcp251x_open(). The fix involves moving the free_irq() call to after the lock is released and setting a flag (priv->force_quit = 1) to ensure the interrupt handler exits immediately once it acquires the lock.
How can this vulnerability impact me? :
This vulnerability can cause a deadlock in the Linux kernel when using the mcp251x driver. A deadlock means that the system or affected process could hang or become unresponsive, potentially leading to system instability or denial of service in environments relying on this driver.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is caused by a deadlock in the mcp251x_open() function in the Linux kernel when free_irq() is called with the mpc_lock mutex held.
To mitigate this issue, update your Linux kernel to a version where this vulnerability is fixed. The fix involves moving the call to free_irq() after the lock is released and setting priv->force_quit = 1 beforehand to ensure the IRQ handler exits immediately once it acquires the lock.