In the Linux kernel, the following vulnerability has been resolved:

can: ucan: Fix infinite loop from zero-length messages

If a broken ucan device gets a message with the message length field set
to 0, then the driver will loop for forever in
ucan_read_bulk_callback(), hanging the system. If the length is 0, just
skip the message and go on to the next one.

This has been fixed in the kvaser_usb driver in the past in commit
0c73772cd2b8 ("can: kvaser_usb: leaf: Fix potential infinite loop in
command parsers"), so there must be some broken devices out there like
this somewhere.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00024.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
9f2d3eae88d26c29d96e42983b755940d9169cd9 affected < ab6f075492d37368b4c7b0df7f7fdc2b666887fc
9f2d3eae88d26c29d96e42983b755940d9169cd9 affected < 13b646eec3ba1131180803f5aaf1fee23540ad8f
9f2d3eae88d26c29d96e42983b755940d9169cd9 affected < bd85f21a6219aeae4389d700c54f1799f4b814e0
9f2d3eae88d26c29d96e42983b755940d9169cd9 affected < aa9e0a7fe5efc2f74327fd37d828e9a51d9ff588
9f2d3eae88d26c29d96e42983b755940d9169cd9 affected < c7bc62be6c1a60bb21301692009590b1ffda91d9
9f2d3eae88d26c29d96e42983b755940d9169cd9 affected < 1e446fd0582ad8be9f6dafb115fc2e7245f9bea7
Linux Linux affected
Version Status Constraints
4.19 affected —
0 unaffected < 4.19
6.1.167 unaffected ≤ 6.1.*
6.6.130 unaffected ≤ 6.6.*
6.12.77 unaffected ≤ 6.12.*
6.18.17 unaffected ≤ 6.18.*
6.19.7 unaffected ≤ 6.19.*
7.0-rc3 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/13b646eec3ba1131180803f5aaf1fee23540ad8f cve-icon cve-icon
https://git.kernel.org/stable/c/1e446fd0582ad8be9f6dafb115fc2e7245f9bea7 cve-icon cve-icon
https://git.kernel.org/stable/c/aa9e0a7fe5efc2f74327fd37d828e9a51d9ff588 cve-icon cve-icon
https://git.kernel.org/stable/c/ab6f075492d37368b4c7b0df7f7fdc2b666887fc cve-icon cve-icon
https://git.kernel.org/stable/c/bd85f21a6219aeae4389d700c54f1799f4b814e0 cve-icon cve-icon
https://git.kernel.org/stable/c/c7bc62be6c1a60bb21301692009590b1ffda91d9 cve-icon cve-icon
History

Wed, 25 Mar 2026 10:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: can: ucan: Fix infinite loop from zero-length messages If a broken ucan device gets a message with the message length field set to 0, then the driver will loop for forever in ucan_read_bulk_callback(), hanging the system. If the length is 0, just skip the message and go on to the next one. This has been fixed in the kvaser_usb driver in the past in commit 0c73772cd2b8 ("can: kvaser_usb: leaf: Fix potential infinite loop in command parsers"), so there must be some broken devices out there like this somewhere.
Title can: ucan: Fix infinite loop from zero-length messages
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-03-25T10:26:54.830Z

Reserved: 2026-01-13T15:37:45.993Z

Link: CVE-2026-23298

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-03-25T11:16:25.320

Modified: 2026-03-25T11:16:25.320

Link: CVE-2026-23298

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.