CVE-2026-23298

A flaw was found in the Linux kernel's CAN (Controller Area Network) ucan driver. This vulnerability allows a connected ucan device to send a message with a zero-length field. Such a message can trigger an infinite loop within the driver, causing the system to hang. This ultimately leads to a denial of service (DoS), making the system unresponsive.

This flaw affects systems with ucan USB-CAN adapters. A malicious or broken device can send zero-length messages that cause the driver to enter an infinite loop in ucan_read_bulk_callback(), hanging the system. Physical access to connect the USB device is required. Similar issues have been fixed in other CAN USB drivers (kvaser_usb).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the ucan module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.