CVE-2026-23357: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23357 is a deadlock vulnerability in the Linux kernel's CAN mcp251x driver that allows a local low-privileged attacker to cause a denial of service. The flaw exists in the mcp251x_open() function, which calls free_irq() in its error path while holding the mpc_lock mutex — if an interrupt occurs simultaneously, the interrupt handler waits for the mutex while free_irq() waits for the handler, creating a deadlock. Affected Linux kernel versions span from 2.6.34 through multiple stable branches, with fixes available in versions 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, 6.19.7, and 7.0-rc3 and later. It was published on March 25, 2026, with a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Microsoft MSRC).

The root cause is classified as CWE-833 (Deadlock) and CWE-667 (Improper Locking). In mcp251x_open(), the error path invokes free_irq() while the mpc_lock mutex is still held; if an interrupt has already fired, the interrupt handler blocks waiting to acquire mpc_lock, while free_irq() blocks waiting for the handler to complete — a classic circular wait deadlock. The fix moves the free_irq() call to after the mutex is released and sets priv->force_quit = 1 beforehand so the IRQ handler exits immediately upon acquiring the lock. This issue is analogous to a previously fixed deadlock addressed in commit 7dd9c26bd6cf but specifically affects the error path rather than the normal open path (Red Hat CVE).

Successful exploitation causes the affected Linux system to deadlock in the kernel's CAN mcp251x driver initialization path, resulting in a denial of service — the system becomes unresponsive or freezes. There is no confidentiality or integrity impact; the vulnerability is limited to availability (CVSS availability impact: High). The attack is local in scope, requires only low privileges, and no user interaction, making it relevant primarily to embedded or industrial systems using MCP251x CAN bus controllers (Red Hat CVE).

Update the Linux kernel to a patched version. Fixed versions include: 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, 6.19.7, and 7.0-rc3 or later. Patches are available via the upstream kernel stable tree and have been incorporated into distributions including Debian (DSA-6243-1, DLA-4561-1), SUSE (SUSE-SU-2026:2217-1, SUSE-SU-2026:2238-1), and Microsoft Azure Linux (azl3_kernel_6.6.126.1-1). Systems using CAN mcp251x controllers should prioritize patching; as a temporary measure, avoiding conditions that trigger mcp251x_open() error paths (e.g., ensuring stable hardware connections) may reduce exposure (Red Hat CVE, Microsoft MSRC, SUSE Advisory).

The vulnerability received routine coverage from Linux distribution security teams, with Debian, SUSE, and Microsoft all issuing advisories and patches. No notable independent researcher commentary or significant social media discussion has been identified, consistent with the moderate severity and limited attack surface of this driver-level flaw (linuxsecurity.com Debian DSA, SUSE Advisory).