CVE-2026-23307
Description
In the Linux kernel, the following vulnerability has been resolved: can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message When looking at the data in a USB urb, the actual_length is the size of the buffer passed to the driver, not the transfer_buffer_length which is set by the driver as the max size of the buffer. When parsing the messages in ems_usb_read_bulk_callback() properly check the size both at the beginning of parsing the message to make sure it is big enough for the expected structure, and at the end of the message to make sure we don't overflow past the end of the buffer for the next message.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| sles | affected | | |
| debian | bookworm | fixed | 6.1.170-1 |
| debian | bullseye | fixed | 6.1.170-1~deb11u1 |
| debian | forky | fixed | 6.19.8-1 |
| debian | sid | fixed | 6.19.8-1 |
| debian | trixie | fixed | 6.12.85-1 |
| linux-kernel | affected | 5.10.253 | |
| linux-kernel | 7.0 | affected | |
References
- https://www.suse.com/security/cve/CVE-2026-23307.html
- https://security-tracker.debian.org/tracker/CVE-2026-23307
- https://git.kernel.org/stable/c/1818974e1b5ef200e27f144c8cb8a246420bb54d
- https://git.kernel.org/stable/c/18f75b9cbdc3703f15965425ab69dee509b07785
- https://git.kernel.org/stable/c/1cf469026d4a2308eaa91d04dca4a900d07a5c2e
- https://git.kernel.org/stable/c/2833e13e2b099546abf5d40a483b4eb04ddd1f7b
- https://git.kernel.org/stable/c/38a01c9700b0dcafe97dfa9dc7531bf4a245deff
- https://git.kernel.org/stable/c/aed172a2e2330131f0977d2acd3ec8883f413ec1
- https://git.kernel.org/stable/c/c703bbf8e9b4947e111c88d2ed09236a6772a471
- https://git.kernel.org/stable/c/f10177e6c4575aedaea580ce67d792fab7a2235e
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.