#VU124556 Out-of-bounds read in Linux kernel - CVE-2026-23307

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU124556

#VU124556 Out-of-bounds read in Linux kernel - CVE-2026-23307

Published: March 25, 2026


Vulnerability identifier: #VU124556
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-23307
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability: No public exploit available
Vulnerable software:
Linux kernel
Software vendor:
Linux Foundation

Description

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the ems_usb_read_bulk_callback() function in the CAN USB driver when handling USB bulk callback data. A local user can provide specially crafted USB input to cause memory access beyond the buffer bounds, leading to a system crash.

The attacker must have local system access and the ability to interact with the CAN USB driver via USB interface.


Remediation

Install security update from vendor's repository.

External links