CVE-2026-23357can: mcp251x: fix deadlock in error path of mcp251x_open
Updated under an hour ago ()
Does this affect you?
It affects Linux and 2 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: can: mcp251x: fix deadlock in error path of mcp251x_open The mcp251x_open() function call free_irq() in its error path with the mpc_lock mutex held. But if an interrupt already occurred the interrupt handler will be waiting for the mpc_lock and free_irq() will deadlock waiting for the handler to finish. This issue is similar to the one fixed in commit 7dd9c26bd6cf ("can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open") but for the error path. To solve this issue move the call to free_irq() after the lock is released. Setting `priv->force_quit = 1` beforehand ensure that the IRQ handler will exit right away once it acquired the lock.
- CVSS
- 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from bf66f3736a945dd4e92d86427276c6eeab0a6c1d before 739454057572cb0948658d1142f3fa2c6966465c; from bf66f3736a945dd4e92d86427276c6eeab0a6c1d before 416c18ecddafab0ed09be1e7b9d2f448f3d4db16; from bf66f3736a945dd4e92d86427276c6eeab0a6c1d before 256f0cff6e946c570392bda1d01a65e789a7afd0; from bf66f3736a945dd4e92d86427276c6eeab0a6c1d before b73832292cd914e87a55e863ba4413a907e7db6b; from bf66f3736a945dd4e92d86427276c6eeab0a6c1d before 38063cc435b69d56e76f947c10d336fcb2953508; from bf66f3736a945dd4e92d86427276c6eeab0a6c1d before d27f12c3f5e85efc479896af4a69eccb37f75e8e; from bf66f3736a945dd4e92d86427276c6eeab0a6c1d before e728f444c913a91d290d1824b4770780bbd6378e; from bf66f3736a945dd4e92d86427276c6eeab0a6c1d before ab3f894de216f4a62adc3b57e9191888cbf26885 | CNA record |
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name) | all versions | CISA ADP |
linux linux_kernel linux:linux_kernel | from 2.6.34.1 before 5.10.253; from 5.11 before 5.15.203; from 5.16 before 6.1.167; from 6.2 before 6.6.130; from 6.7 before 6.12.77; from 6.13 before 6.18.17; from 6.19 before 6.19.7; 2.6.34; and 7 more ranges | NVD |
References
- https://git.kernel.org/stable/c/739454057572cb0948658d1142f3fa2c6966465cpatch
- https://git.kernel.org/stable/c/416c18ecddafab0ed09be1e7b9d2f448f3d4db16patch
- https://git.kernel.org/stable/c/256f0cff6e946c570392bda1d01a65e789a7afd0patch
- https://git.kernel.org/stable/c/b73832292cd914e87a55e863ba4413a907e7db6bpatch
- https://git.kernel.org/stable/c/38063cc435b69d56e76f947c10d336fcb2953508patch
- https://git.kernel.org/stable/c/d27f12c3f5e85efc479896af4a69eccb37f75e8epatch
- https://git.kernel.org/stable/c/e728f444c913a91d290d1824b4770780bbd6378epatch
- https://git.kernel.org/stable/c/ab3f894de216f4a62adc3b57e9191888cbf26885patch
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.