CVE-2026-23155: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23155 is a NULL pointer dereference vulnerability in the Linux kernel's CAN gs_usb driver, specifically within the gs_usb_receive_bulk_callback() function. The flaw was introduced in the context of commit 79a6d1bfe114, which added error handling for failed URB resubmission; in a short-read scenario where netdev has not yet been assigned, the pointer is left uninitialized rather than set to NULL, risking a dereference of an undefined value. It affects Linux kernel versions including stable branches up to 6.6.122, 6.12.68, 6.18.8, and pre-release 6.19-rc7. The vulnerability was published on February 14, 2026, with patches released on March 18, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is a NULL pointer dereference (CWE-476) in the gs_usb_receive_bulk_callback() function of the Linux kernel's can/gs_usb driver. When a USB bulk transfer results in a short read and the netdev pointer has not yet been assigned, the code proceeds to use the uninitialized pointer value rather than a safe NULL, which can trigger a kernel crash when the error-path logging attempts to dereference it. The attack vector is local (AV:L), requires low privileges (PR:L), and no user interaction, making it exploitable by any local user with access to a system using a gs_usb CAN adapter. The fix initializes netdev to NULL in the short-read path and also corrects the error reporting to include the actual return value of the failed usb_submit_urb() call (Feedly, Kernel Patch 1).

Successful exploitation causes a kernel NULL pointer dereference, resulting in a system crash (kernel panic) and denial of service. There is no confidentiality or integrity impact — the vulnerability is limited to availability (A:H). The affected scope is limited to systems with a gs_usb CAN-over-USB adapter attached and running a vulnerable kernel version (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2026-23155. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available from Nessus (plugin 299217) and Qualys (plugins 761735, 164196, 761861) (Feedly, Tenable).

Apply the upstream Linux kernel patches released on March 18, 2026, which are available for multiple stable branches: kernel 6.6.x (commit 494fc029), 6.12.x (commit 8986cdf5), 6.18.x (commit 713ba826), and additional stable branches (commits 923379f1 and aed58a28). Users should update to patched kernel versions (6.6.122+, 6.12.68+, 6.18.8+, or later) as provided by their Linux distribution. As a temporary workaround where patching is not immediately possible, avoiding attachment of gs_usb CAN-over-USB adapters on sensitive systems reduces exposure (Kernel Patch 1, Kernel Patch 2, Kernel Patch 3).