CVE-2026-22997: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-22997 is a resource leak (reference count leak) vulnerability in the Linux kernel's CAN J1939 protocol implementation, specifically in the j1939_xtp_rx_rts_session_active() function. When a second Request-To-Send (RTS) message is received, the function fails to call j1939_session_deactivate_activate_next() after cancelling the timer, causing a refcount leak in the j1939_session object. This prevents proper cleanup of network resources and manifests as a system hang when attempting to unregister the affected CAN network device (e.g., unregister_netdevice: waiting for vcan0 to become free. Usage count = 2). Affected Linux kernel versions span 5.4.x through 6.18.6 and 6.19-rc1 through rc5. The CVSS v3.1 base score is 5.5 (Medium) per NIST NVD, and 7.5 (High) per kernel.org CNA (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a missing call to j1939_session_deactivate_activate_next() in the j1939_xtp_rx_rts_session_active() function when a second RTS message is received and the session timer is cancelled. Because j1939_session_deactivate_activate_next() is normally invoked only from j1939_tp_rxtimer() when the timer fires, cancelling the timer without also calling the deactivation function leaves the j1939_session reference count elevated. This is classified as an improper resource management / reference count leak issue (CWE-noinfo per NVD). The attack vector is local (AV:L), requiring low privileges, and exploitation involves sending specially crafted CAN J1939 protocol messages to trigger the double-RTS condition (Red Hat Bugzilla, Feedly).

Exploitation of this vulnerability results in a denial-of-service condition affecting the availability of the CAN network subsystem. A local, low-privileged attacker can cause kernel resources to accumulate without being freed, eventually preventing the CAN network device (e.g., vcan0) from being properly unregistered or deallocated. There is no impact on confidentiality or integrity; the sole impact is availability (A:H). Systems relying on CAN J1939 networking — common in automotive, industrial, and embedded environments — are most at risk of service disruption (Feedly).

• Logs: Kernel log messages containing unregister_netdevice: waiting for vcan0 to become free. Usage count = 2 (or similar usage count > 1 for CAN interfaces), indicating a reference count leak in the J1939 session subsystem.
• Process/System Behavior: CAN network interfaces (e.g., vcan0, can0) that fail to unregister or become stuck in a persistent state during shutdown or reconfiguration.
• Kernel Diagnostics: Repeated or unexpected J1939 session state transitions visible via kernel debug logging (dmesg) related to j1939_xtp_rx_rts_session_active or J1939 transport protocol timer cancellations.

Update the Linux kernel to one of the following patched stable versions: 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.67, 6.18.7, or 6.19-rc6 and later. Patches are available via the kernel.org stable git repositories. As a temporary workaround, restrict local user access to systems running affected kernel versions and limit access to CAN interfaces. Monitor kernel logs for the unregister_netdevice: waiting for ... to become free warning as an indicator of the issue being triggered. Ubuntu has issued multiple security notices (USN-8162-1, USN-8180-1 through USN-8180-6, USN-8186-1, USN-8188-1, USN-8275-1, USN-8278-1, USN-8289-1, USN-8296-1, USN-8297-1) addressing this CVE (Ubuntu USN-8162-1, kernel.org patches).

Red Hat triaged this as low severity/priority and opened a tracking bug via their OSIDB system. The vulnerability received routine coverage from Linux security aggregators including linuxsecurity.com and pro-linux.de, and was picked up by Yocto Project security mailing lists. No notable researcher commentary or significant social media discussion has been observed beyond standard vulnerability tracking channels.