CVE-2026-23307: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23307 is a buffer access vulnerability with incorrect length value in the Linux kernel's CAN ems_usb driver. The flaw exists in the ems_usb_read_bulk_callback() function, which fails to properly validate USB message lengths — specifically, it uses transfer_buffer_length (the driver-set maximum) rather than actual_length (the true received size), enabling buffer overflows when parsing USB URB data. It affects the Linux kernel from version 2.6.32 through multiple stable branches, with fixed versions including 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, 6.19.7, and 7.0-rc3. The vulnerability was published on March 25, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Feedly).

The root cause is classified as CWE-805 (Buffer Access with Incorrect Length Value). In ems_usb_read_bulk_callback(), the driver incorrectly uses transfer_buffer_length — the maximum buffer size set by the driver — instead of actual_length, which reflects the actual data received in the USB URB. This means the function does not verify that the received message is large enough to satisfy the expected structure at the start of parsing, nor does it check buffer boundaries at the end of parsing before advancing to the next message, potentially reading or processing memory beyond the valid data region. The attack vector is local (AV:L), requiring low privileges, and no user interaction is needed (Red Hat CVE, Feedly).

Successful exploitation allows a local attacker with access to CAN device operations to trigger a kernel crash, resulting in a denial of service. There is no confidentiality or integrity impact — the primary consequence is high availability impact, as the kernel can be forced into an unrecoverable state. The scope is limited to the affected system; lateral movement or data exfiltration are not direct outcomes of this vulnerability (Red Hat CVE, Feedly).

Apply kernel updates from your Linux distribution vendor that include the fix for CVE-2026-23307. Fixed upstream kernel versions are: 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, 6.19.7, and 7.0-rc3. For Microsoft Azure Linux 3 systems, apply kernel version 6.6.126.1-1 or later. As a workaround where patching is not immediately possible, restrict local access to CAN device operations to trusted users only, or unload/blacklist the ems_usb kernel module if the hardware is not in use (Red Hat CVE, Microsoft MSRC, SUSE Advisory).