CVE-2026-23155: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23155 is a NULL pointer dereference vulnerability in the Linux kernel's CAN gs_usb driver, specifically within the gs_usb_receive_bulk_callback() function. The flaw was introduced in the context of commit 79a6d1bfe114, which added error handling for failed URB resubmission; in a short-read scenario where netdev has not yet been assigned, the pointer is left uninitialized rather than set to NULL, risking a dereference of an undefined value. It affects Linux kernel versions including stable branches up to 6.6.122, 6.12.68, 6.18.8, and pre-release 6.19-rc7. The vulnerability was published on February 14, 2026, with patches released on March 18, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is a NULL pointer dereference (CWE-476) in the gs_usb_receive_bulk_callback() function of the Linux kernel's can/gs_usb driver. When a USB bulk transfer results in a short read and the netdev pointer has not yet been assigned, the code proceeds to use the uninitialized pointer value rather than a safe NULL, which can trigger a kernel crash when the error-path logging attempts to dereference it. The attack vector is local (AV:L), requires low privileges (PR:L), and no user interaction, making it exploitable by any local user with access to a system using a gs_usb CAN adapter. The fix initializes netdev to NULL in the short-read path and also corrects the error reporting to include the actual return value of the failed usb_submit_urb() call (Feedly, Kernel Patch 1).

Successful exploitation causes a kernel NULL pointer dereference, resulting in a system crash (kernel panic) and denial of service. There is no confidentiality or integrity impact — the vulnerability is limited to availability (A:H). The affected scope is limited to systems with a gs_usb CAN-over-USB adapter attached and running a vulnerable kernel version (Feedly).

Apply the upstream Linux kernel patches released on March 18, 2026, which are available for multiple stable branches: kernel 6.6.x (commit 494fc029), 6.12.x (commit 8986cdf5), 6.18.x (commit 713ba826), and additional stable branches (commits 923379f1 and aed58a28). Users should update to patched kernel versions (6.6.122+, 6.12.68+, 6.18.8+, or later) as provided by their Linux distribution. As a temporary workaround where patching is not immediately possible, avoiding attachment of gs_usb CAN-over-USB adapters on sensitive systems reduces exposure (Kernel Patch 1, Kernel Patch 2, Kernel Patch 3).