CVE-2026-23298None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: can: ucan: Fix infinite loop from zero-length messages If a broken ucan device gets a message with the message length field set to 0, then the driver will loop for for…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.1%
In the Linux kernel, the following vulnerability has been resolved:
can: ucan: Fix infinite loop from zero-length messages
If a broken ucan device gets a message with the message length field set to 0, then the driver will loop for forever in ucan_read_bulk_callback(), hanging the system. If the length is 0, just skip the message and go on to the next one.
This has been fixed in the kvaser_usb driver in the past in commit 0c73772cd2b8 ("can: kvaser_usb: leaf: Fix potential infinite loop in command parsers"), so there must be some broken devices out there like this somewhere.
Linux >= 9f2d3eae88d26c29d96e42983b755940d9169cd9 < ca07d3c6eef14d34e6fdeefe55058db045be29dcLinux >= 9f2d3eae88d26c29d96e42983b755940d9169cd9 < e7bb6e0606b5f233531aaaad9542d69fbb792115Linux >= 9f2d3eae88d26c29d96e42983b755940d9169cd9 < ab6f075492d37368b4c7b0df7f7fdc2b666887fcLinux >= 9f2d3eae88d26c29d96e42983b755940d9169cd9 < 13b646eec3ba1131180803f5aaf1fee23540ad8fLinux >= 9f2d3eae88d26c29d96e42983b755940d9169cd9 < bd85f21a6219aeae4389d700c54f1799f4b814e0Linux >= 9f2d3eae88d26c29d96e42983b755940d9169cd9 < aa9e0a7fe5efc2f74327fd37d828e9a51d9ff588Linux >= 9f2d3eae88d26c29d96e42983b755940d9169cd9 < c7bc62be6c1a60bb21301692009590b1ffda91d9Linux >= 9f2d3eae88d26c29d96e42983b755940d9169cd9 < 1e446fd0582ad8be9f6dafb115fc2e7245f9bea7Linux 4.19Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99284Nonenet: skbuff: propagate shared-frag marker in skb_zerocopy()
CVE-2026-99283Nonenetfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets
CVE-2026-99272Nonesmb: client: validate the data area in SMB2_read()
CVE-2026-99271NoneALSA: line6: Clear prev_fbuf on capture buffer release
CVE-2026-99273Noneksmbd: reserve space for the UTF-16 terminator in stream info
CVE-2026-99275Nonesmb: client: reject short SESSION_SETUP responses