A bug in the Linux kernel CAN J1939 driver prevents the j1939_session from being deactivated when a second request-to-send (RTS) frame is received. The omission of a necessary call causes the session reference count to leak, which later manifests as errors such as "unregister_netdevice: waiting for vcan0 to become free. Usage count = 2." The leaked reference count can keep a virtual CAN device from being reclaimed, leading to resource exhaustion or a denial of service on the affected system.

The flaw affects the Linux kernel, specifically the 6.19 release candidate series (rc1 through rc5). Vendors delivering kernels from this series are impacted.

The CVSS score is 5.5, indicating moderate severity. The EPSS score is below 1%, implying a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, so there is no known widespread exploitation. The attack requires local or fragment-level access to send CAN J1939 frames to a device; it is not exploitable over the network. In practice, an attacker would need to inject malformed or excessive RTS frames on a host that has active CAN interfaces, and the impact would be a gradual depletion of reference counts and eventual kernel or device unavailability.