A bug in the Linux kernel CAN J1939 driver prevents the j1939_session from being deactivated when a second request‑to‑send (RTS) frame is received. The missing call causes the session reference count to leak, which later manifests as errors such as unregister_netdevice: waiting for vcan0 to become free. The leaked reference count can keep a virtual CAN device from being reclaimed, presenting a resource exhaustion problem that may degrade system stability or trigger a denial of service in the kernel or affected device.

The flaw affects the Linux kernel across all 6.19 release‑candidate series, from rc1 through rc5. Any system delivering these kernel versions with active CAN J1939 support (including virtual CAN devices) is impacted. Downstream vendors shipping kernels from this series are also susceptible.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of < 1% shows a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. The likely attack vector is local or requires access to send CAN J1939 frames to a device; it is unlikely to be exploitable over the public network. An attacker would need to inject repeated or malformed RTS frames on a host with active CAN interfaces, leading to gradual depletion of reference counts, device unreclamation, and eventual kernel or device unavailability.