CVE-2026-23155

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23155", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.977Z", "datePublished": "2026-02-14T16:01:22.429Z", "dateUpdated": "2026-11-05T21:23:19.837Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:01:16.668Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: gs_usb: gs_usb_receive_bulk_callback(): fix error message\n\nSinc commit 79a6d1bfe114 (\"can: gs_usb: gs_usb_receive_bulk_callback():\nunanchor URL on usb_submit_urb() error\") a failing resubmit URB will print\nan info message.\n\nIn the case of a short read where netdev has not yet been assigned,\ninitialize as NULL to avoid dereferencing an undefined value. Also report\nthe error value of the failed resubmit."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/can/usb/gs_usb.c"], "versions": [{"version": "da01de754e455e2598a7f1ce4ff2078c4f0ecde1", "lessThan": "7a431df418ee6b79841e0b4c7c265a791e3d0a75", "status": "affected", "versionType": "git"}, {"version": "aa8a8866c533a150be4763bcb27993603bd5426c", "lessThan": "aed58a28ea71a0d7d0947190fab1e3f4daa1d4a5", "status": "affected", "versionType": "git"}, {"version": "ce4352057fc5a986c76ece90801b9755e7c6e56c", "lessThan": "923379f1d7e3af8ccbf11edbbcf41f1bb3e9cfe6", "status": "affected", "versionType": "git"}, {"version": "c610b550ccc0438d456dfe1df9f4f36254ccaae3", "lessThan": "8986cdf52f86208df9c7887fee23365b5d37da26", "status": "affected", "versionType": "git"}, {"version": "c3edc14da81a8d8398682f6e4ab819f09f37c0b7", "lessThan": "713ba826ae114ab339c9a1b31e209bebdadb0ac9", "status": "affected", "versionType": "git"}, {"version": "79a6d1bfe1148bc921b8d7f3371a7fbce44e30f7", "lessThan": "494fc029f662c331e06b7c2031deff3c64200eed", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/can/usb/gs_usb.c"], "versions": [{"version": "6.6.122", "lessThan": "6.6.123", "status": "affected", "versionType": "semver"}, {"version": "6.12.68", "lessThan": "6.12.69", "status": "affected", "versionType": "semver"}, {"version": "6.18.8", "lessThan": "6.18.9", "status": "affected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.122", "versionEndExcluding": "6.6.123"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.68", "versionEndExcluding": "6.12.69"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.8", "versionEndExcluding": "6.18.9"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/7a431df418ee6b79841e0b4c7c265a791e3d0a75"}, {"url": "https://git.kernel.org/stable/c/aed58a28ea71a0d7d0947190fab1e3f4daa1d4a5"}, {"url": "https://git.kernel.org/stable/c/923379f1d7e3af8ccbf11edbbcf41f1bb3e9cfe6"}, {"url": "https://git.kernel.org/stable/c/8986cdf52f86208df9c7887fee23365b5d37da26"}, {"url": "https://git.kernel.org/stable/c/713ba826ae114ab339c9a1b31e209bebdadb0ac9"}, {"url": "https://git.kernel.org/stable/c/494fc029f662c331e06b7c2031deff3c64200eed"}], "title": "can: gs_usb: gs_usb_receive_bulk_callback(): fix error message", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23155", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:20:59.213615Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:23:19.837Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23155", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:20:59.213615Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:21:00.305Z"}}], "cna": {"title": "can: gs_usb: gs_usb_receive_bulk_callback(): fix error message", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "da01de754e455e2598a7f1ce4ff2078c4f0ecde1", "lessThan": "7a431df418ee6b79841e0b4c7c265a791e3d0a75", "versionType": "git"}, {"status": "affected", "version": "aa8a8866c533a150be4763bcb27993603bd5426c", "lessThan": "aed58a28ea71a0d7d0947190fab1e3f4daa1d4a5", "versionType": "git"}, {"status": "affected", "version": "ce4352057fc5a986c76ece90801b9755e7c6e56c", "lessThan": "923379f1d7e3af8ccbf11edbbcf41f1bb3e9cfe6", "versionType": "git"}, {"status": "affected", "version": "c610b550ccc0438d456dfe1df9f4f36254ccaae3", "lessThan": "8986cdf52f86208df9c7887fee23365b5d37da26", "versionType": "git"}, {"status": "affected", "version": "c3edc14da81a8d8398682f6e4ab819f09f37c0b7", "lessThan": "713ba826ae114ab339c9a1b31e209bebdadb0ac9", "versionType": "git"}, {"status": "affected", "version": "79a6d1bfe1148bc921b8d7f3371a7fbce44e30f7", "lessThan": "494fc029f662c331e06b7c2031deff3c64200eed", "versionType": "git"}], "programFiles": ["drivers/net/can/usb/gs_usb.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.6.122", "lessThan": "6.6.123", "versionType": "semver"}, {"status": "affected", "version": "6.12.68", "lessThan": "6.12.69", "versionType": "semver"}, {"status": "affected", "version": "6.18.8", "lessThan": "6.18.9", "versionType": "semver"}], "programFiles": ["drivers/net/can/usb/gs_usb.c"], "defaultStatus": "unaffected"}], "references": [{"url": "https://git.kernel.org/stable/c/7a431df418ee6b79841e0b4c7c265a791e3d0a75"}, {"url": "https://git.kernel.org/stable/c/aed58a28ea71a0d7d0947190fab1e3f4daa1d4a5"}, {"url": "https://git.kernel.org/stable/c/923379f1d7e3af8ccbf11edbbcf41f1bb3e9cfe6"}, {"url": "https://git.kernel.org/stable/c/8986cdf52f86208df9c7887fee23365b5d37da26"}, {"url": "https://git.kernel.org/stable/c/713ba826ae114ab339c9a1b31e209bebdadb0ac9"}, {"url": "https://git.kernel.org/stable/c/494fc029f662c331e06b7c2031deff3c64200eed"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: gs_usb: gs_usb_receive_bulk_callback(): fix error message\n\nSinc commit 79a6d1bfe114 (\"can: gs_usb: gs_usb_receive_bulk_callback():\nunanchor URL on usb_submit_urb() error\") a failing resubmit URB will print\nan info message.\n\nIn the case of a short read where netdev has not yet been assigned,\ninitialize as NULL to avoid dereferencing an undefined value. Also report\nthe error value of the failed resubmit."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.123", "versionStartIncluding": "6.6.122"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.69", "versionStartIncluding": "6.12.68"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.9", "versionStartIncluding": "6.18.8"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:01:16.668Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23155", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:23:19.837Z", "dateReserved": "2026-01-13T15:37:45.977Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-02-14T16:01:22.429Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/can/usb/gs_usb.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "7a431df418ee6b79841e0b4c7c265a791e3d0a75", "status": "affected", "version": "da01de754e455e2598a7f1ce4ff2078c4f0ecde1", "versionType": "git"}, {"lessThan": "aed58a28ea71a0d7d0947190fab1e3f4daa1d4a5", "status": "affected", "version": "aa8a8866c533a150be4763bcb27993603bd5426c", "versionType": "git"}, {"lessThan": "923379f1d7e3af8ccbf11edbbcf41f1bb3e9cfe6", "status": "affected", "version": "ce4352057fc5a986c76ece90801b9755e7c6e56c", "versionType": "git"}, {"lessThan": "8986cdf52f86208df9c7887fee23365b5d37da26", "status": "affected", "version": "c610b550ccc0438d456dfe1df9f4f36254ccaae3", "versionType": "git"}, {"lessThan": "713ba826ae114ab339c9a1b31e209bebdadb0ac9", "status": "affected", "version": "c3edc14da81a8d8398682f6e4ab819f09f37c0b7", "versionType": "git"}, {"lessThan": "494fc029f662c331e06b7c2031deff3c64200eed", "status": "affected", "version": "79a6d1bfe1148bc921b8d7f3371a7fbce44e30f7", "versionType": "git"}]}, {"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/can/usb/gs_usb.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6.6.123", "status": "affected", "version": "6.6.122", "versionType": "semver"}, {"lessThan": "6.12.69", "status": "affected", "version": "6.12.68", "versionType": "semver"}, {"lessThan": "6.18.9", "status": "affected", "version": "6.18.8", "versionType": "semver"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:6.6.122:*:*:*:*:*:*:*", "matchCriteriaId": "86B92AB2-1FB7-4D1D-8D0C-B6FE241FB4B5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.12.68:*:*:*:*:*:*:*", "matchCriteriaId": "6B0724BD-589D-42C4-9456-646D8CBCF8A4", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.18.8:*:*:*:*:*:*:*", "matchCriteriaId": "1356361D-D06B-4A76-8D92-0B20D30F3D59", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*", "matchCriteriaId": "F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: gs_usb: gs_usb_receive_bulk_callback(): fix error message\n\nSinc commit 79a6d1bfe114 (\"can: gs_usb: gs_usb_receive_bulk_callback():\nunanchor URL on usb_submit_urb() error\") a failing resubmit URB will print\nan info message.\n\nIn the case of a short read where netdev has not yet been assigned,\ninitialize as NULL to avoid dereferencing an undefined value. Also report\nthe error value of the failed resubmit."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncan: gs_usb: gs_usb_receive_bulk_callback(): corregir mensaje de error\n\nDesde el commit 79a6d1bfe114 ('can: gs_usb: gs_usb_receive_bulk_callback(): desanclar URL en error de usb_submit_urb()'), un URB de reenv\u00edo fallido imprimir\u00e1 un mensaje de informaci\u00f3n.\n\nEn el caso de una lectura corta donde netdev a\u00fan no ha sido asignado, inicializar como NULL para evitar desreferenciar un valor indefinido. Tambi\u00e9n informar el valor de error del reenv\u00edo fallido."}], "id": "CVE-2026-23155", "lastModified": "2026-11-05T22:18:04.720", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23155", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:20:59.213615Z", "version": "2.0.3"}}]}, "published": "2026-02-14T16:15:55.653", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/494fc029f662c331e06b7c2031deff3c64200eed"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/713ba826ae114ab339c9a1b31e209bebdadb0ac9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7a431df418ee6b79841e0b4c7c265a791e3d0a75"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8986cdf52f86208df9c7887fee23365b5d37da26"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/923379f1d7e3af8ccbf11edbbcf41f1bb3e9cfe6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/aed58a28ea71a0d7d0947190fab1e3f4daa1d4a5"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: can: gs_usb: gs_usb_receive_bulk_callback(): fix error message", "id": "2439898", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439898"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\ncan: gs_usb: gs_usb_receive_bulk_callback(): fix error message\nSinc commit 79a6d1bfe114 (\"can: gs_usb: gs_usb_receive_bulk_callback():\nunanchor URL on usb_submit_urb() error\") a failing resubmit URB will print\nan info message.\nIn the case of a short read where netdev has not yet been assigned,\ninitialize as NULL to avoid dereferencing an undefined value. Also report\nthe error value of the failed resubmit."], "name": "CVE-2026-23155", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-02-14T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23155\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23155\nhttps://lore.kernel.org/linux-cve-announce/2026021415-CVE-2026-23155-32be@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[aa8a8866c533a150be4763bcb27993603bd5426c,aed58a28ea71a0d7d0947190fab1e3f4daa1d4a5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ce4352057fc5a986c76ece90801b9755e7c6e56c,923379f1d7e3af8ccbf11edbbcf41f1bb3e9cfe6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c610b550ccc0438d456dfe1df9f4f36254ccaae3,8986cdf52f86208df9c7887fee23365b5d37da26)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c3edc14da81a8d8398682f6e4ab819f09f37c0b7,713ba826ae114ab339c9a1b31e209bebdadb0ac9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[79a6d1bfe1148bc921b8d7f3371a7fbce44e30f7,494fc029f662c331e06b7c2031deff3c64200eed)"}}], "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.6.122,6.6.123)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.12.68,6.12.69)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.18.8,6.18.9)"}}], "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-18T12:20:13.760448+00:00", "value": {"mitigation_remediation": ["Apply a kernel version that includes commit 79a6d1bfe114 or later (e.g., release 6.12.68+, 6.18.8+, 6.6.122+, or 6.19rc7+).", "Disable the CAN gs_usb driver until a patched kernel is available.", "Configure the system to allow USB resubmit operations only from trusted devices or restrict them via udev rules."], "summary": {"action": "Patch Now", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "Affected versions include Linux kernel 6.12.68, 6.18.8, 6.6.122, and the 6.19rc7 release. Distributions shipping any of these kernels are vulnerable until the commit that removes the dereference is applied.", "description_and_impact": "The Linux kernel CAN gs_usb driver had a null pointer dereference that could be triggered during a failed USB request block (URB) resubmit when a short read occurred and the network device had not yet been assigned. The dereference could cause a kernel crash, resulting in a denial\u2011of\u2011service. The weakness is classified as CWE\u2011476.", "risk_and_exploitability": "The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in CISA\u2019s KEV catalog. Based on the description, it is inferred that exploitation would likely require local or physical access to a machine, such as injection of a malicious USB payload or manipulation of a CAN gs_usb operation. Such local exploitation could lead to a system crash, disrupting availability."}}}}, "created": "2026-02-16T12:01:12.374052+00:00", "title": "Kernel Null Pointer Dereference in CAN gs_usb Driver May Cause System Crash", "updated": "2026-04-18T12:30:45.453038+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}