CVE-2026-22997

A reference count leak vulnerability was found in the Linux kernel's CAN J1939 protocol implementation. When a second RTS (Request To Send) message is received on an active session and the timer is cancelled, j1939_session_deactivate_activate_next() is not called, causing the j1939_session reference count to leak. This prevents the network device from being unregistered, resulting in "waiting for vcan0 to become free" messages.

This vulnerability affects systems using the CAN bus J1939 protocol for vehicle and industrial networking. The reference leak accumulates over time with repeated RTS message handling, eventually preventing network interface cleanup. Exploitation requires the ability to send CAN J1939 traffic, typically requiring physical CAN bus access or local socket access.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the can_j1939 module from being loaded if J1939 CAN protocol support is not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.