CVE-2026-23307In the Linux kernel, the following vulnerability has been resolved: can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message When looking at the data in a USB urb, the actual_…
Updated under an hour ago ()
Does this affect you?
It affects linux_kernel. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message When looking at the data in a USB urb, the actual_length is the size of the buffer passed to the driver, not the transfer_buffer_length which is set by the driver as the max size of the buffer. When parsing the messages in ems_usb_read_bulk_callback() properly check the size both at the beginning of parsing the message to make sure it is big enough for the expected structure, and at the end of the message to make sure we don't overflow past the end of the buffer for the next message.
- CVSS
- 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Not given
- NVD analysis
- Analyzed
- Record last updated
- Jun 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
linux linux_kernel linux:linux_kernel | from 2.6.32 before 5.10.253; from 5.11 before 5.15.203; from 5.16 before 6.1.167; from 6.2 before 6.6.130; from 6.7 before 6.12.77; from 6.13 before 6.18.17; from 6.19 before 6.19.7; 7.0; and 1 more ranges | NVD |
References
- https://git.kernel.org/stable/c/1818974e1b5ef200e27f144c8cb8a246420bb54dpatch
- https://git.kernel.org/stable/c/18f75b9cbdc3703f15965425ab69dee509b07785patch
- https://git.kernel.org/stable/c/1cf469026d4a2308eaa91d04dca4a900d07a5c2epatch
- https://git.kernel.org/stable/c/2833e13e2b099546abf5d40a483b4eb04ddd1f7bpatch
- https://git.kernel.org/stable/c/38a01c9700b0dcafe97dfa9dc7531bf4a245deffpatch
- https://git.kernel.org/stable/c/aed172a2e2330131f0977d2acd3ec8883f413ec1patch
- https://git.kernel.org/stable/c/c703bbf8e9b4947e111c88d2ed09236a6772a471patch
- https://git.kernel.org/stable/c/f10177e6c4575aedaea580ce67d792fab7a2235epatch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.