CVE-2026-23307 can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message
A missing length check in the Linux kernel EMS USB CAN driver allows buffer overflows, potentially leading to system crashes or arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23307?
CVE-2026-23307 is a medium-severity memory corruption vulnerability in Linux kernel, published on 25 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message
When looking at the data in a USB urb, the actual_length is the size of the buffer passed to the driver, not the transfer_buffer_length which is set by the driver as the max size of the buffer.
When parsing the messages in ems_usb_read_bulk_callback() properly check the size both at the beginning of parsing the message to make sure it is big enough for the expected structure, and at the end of the message to make sure we don't overflow past the end of the buffer for the next message.
Which versions are affected by CVE-2026-23307?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-23307?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-23307 being exploited?
There is no known exploitation of CVE-2026-23307 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-80624, BELL-CVE-2026-23307, DEBIAN-CVE-2026-23307, GHSA-hg9v-crxc-wx3j, ROOT-OS-DEBIAN-11-CVE-2026-23307, ROOT-OS-DEBIAN-12-CVE-2026-23307 and 4 more.