CVE-2026-23298: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23298 is an infinite loop vulnerability in the Linux kernel's ucan (USB CAN) driver that allows a local attacker to hang the system by connecting a malformed USB device. The flaw exists in the ucan_read_bulk_callback() function, which fails to handle messages with a zero-length field, causing an infinite loop that renders the system unresponsive. It affects multiple Linux kernel stable branches from 4.19 up to (but not including) the patched versions. It was published on March 25, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Feedly).

The root cause is classified under CWE-606 (Unchecked Input for Loop Condition) and CWE-835 (Loop with Unreachable Exit Condition / Infinite Loop). When the ucan driver's ucan_read_bulk_callback() processes a USB bulk transfer, it iterates over messages using the message length field to advance through the buffer. If a malformed or broken ucan device sends a message with a length of 0, the loop never advances and runs indefinitely, hanging the kernel. The fix adds a check to skip zero-length messages and continue to the next one — analogous to a prior fix applied to the kvaser_usb driver in commit 0c73772cd2b8. Exploitation requires local access and the ability to connect or emulate a malicious USB CAN device (Red Hat CVE).

Successful exploitation results in a complete denial of service: the system hangs indefinitely due to the infinite loop in the kernel driver, requiring a hard reboot to recover. There is no confidentiality or integrity impact — only availability is affected. The scope is limited to the local system running the vulnerable kernel with ucan driver support enabled (Red Hat CVE).

Update the Linux kernel to a patched stable version. Fixed versions include: 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, 6.19.7, and 7.0-rc3. Patches are available via the upstream kernel git repository across multiple stable branches (Red Hat CVE). As a workaround where immediate patching is not possible, restrict physical USB port access and disable the ucan kernel module (modprobe -r ucan) on systems that do not require USB CAN device support. SUSE and Debian have also issued distribution-specific security updates addressing this CVE (SUSE Advisory, Debian DSA).