CVE-2026-23155 - Vulnerability Details

- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message

Description

In the Linux kernel, the following vulnerability has been resolved:

can: gs_usb: gs_usb_receive_bulk_callback(): fix error message

Sinc commit 79a6d1bfe114 ("can: gs_usb: gs_usb_receive_bulk_callback():
unanchor URL on usb_submit_urb() error") a failing resubmit URB will print
an info message.

In the case of a short read where netdev has not yet been assigned,
initialize as NULL to avoid dereferencing an undefined value. Also report
the error value of the failed resubmit.

Published: 2026-02-14

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel CAN gs_usb driver had a null pointer dereference that could be triggered during a failed USB request block (URB) resubmit when a short read occurred and the network device had not yet been assigned. The dereference could cause a kernel crash, resulting in a denial‑of‑service. The weakness is classified as CWE‑476.

Affected Systems

Affected versions include Linux kernel 6.12.68, 6.18.8, 6.6.122, and the 6.19rc7 release. Distributions shipping any of these kernels are vulnerable until the commit that removes the dereference is applied.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that exploitation would likely require local or physical access to a machine, such as injection of a malicious USB payload or manipulation of a CAN gs_usb operation. Such local exploitation could lead to a system crash, disrupting availability.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`da01de754e455e2598a7f1ce4ff2078c4f0ecde1`	affected	< 7a431df418ee6b79841e0b4c7c265a791e3d0a75
`aa8a8866c533a150be4763bcb27993603bd5426c`	affected	< aed58a28ea71a0d7d0947190fab1e3f4daa1d4a5
`ce4352057fc5a986c76ece90801b9755e7c6e56c`	affected	< 923379f1d7e3af8ccbf11edbbcf41f1bb3e9cfe6
`c610b550ccc0438d456dfe1df9f4f36254ccaae3`	affected	< 8986cdf52f86208df9c7887fee23365b5d37da26
`c3edc14da81a8d8398682f6e4ab819f09f37c0b7`	affected	< 713ba826ae114ab339c9a1b31e209bebdadb0ac9
`79a6d1bfe1148bc921b8d7f3371a7fbce44e30f7`	affected	< 494fc029f662c331e06b7c2031deff3c64200eed

Linux

unaffected

Version	Status	Constraints
`6.6.122`	affected	< 6.6.123
`6.12.68`	affected	< 6.12.69
`6.18.8`	affected	< 6.18.9

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel:6.6.122:::::::*
	cpe:2.3:o:linux:linux_kernel:6.12.68:::::::*
	cpe:2.3:o:linux:linux_kernel:6.18.8:::::::*
	cpe:2.3:o:linux:linux_kernel:6.19:rc7::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

—

Version	Status	Scheme	Platform
`[aa8a8866c533a150be4763bcb27993603bd5426c,aed58a28ea71a0d7d0947190fab1e3f4daa1d4a5)`	affected	code_commit	—
`[ce4352057fc5a986c76ece90801b9755e7c6e56c,923379f1d7e3af8ccbf11edbbcf41f1bb3e9cfe6)`	affected	code_commit	—
`[c610b550ccc0438d456dfe1df9f4f36254ccaae3,8986cdf52f86208df9c7887fee23365b5d37da26)`	affected	code_commit	—
`[c3edc14da81a8d8398682f6e4ab819f09f37c0b7,713ba826ae114ab339c9a1b31e209bebdadb0ac9)`	affected	code_commit	—
`[79a6d1bfe1148bc921b8d7f3371a7fbce44e30f7,494fc029f662c331e06b7c2031deff3c64200eed)`	affected	code_commit	—

Linux

Linux Kernel

—

Version	Status	Scheme	Platform
`[6.6.122,6.6.123)`	affected	semver	—
`[6.12.68,6.12.69)`	affected	semver	—
`[6.18.8,6.18.9)`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a kernel version that includes commit 79a6d1bfe114 or later (e.g., release 6.12.68+, 6.18.8+, 6.6.122+, or 6.19rc7+).
Disable the CAN gs_usb driver until a patched kernel is available.
Configure the system to allow USB resubmit operations only from trusted devices or restrict them via udev rules.

Generated by OpenCVE AI on April 18, 2026 at 12:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00015.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/494fc029f662c331e06b7c2031deff3c64200eed
https://git.kernel.org/stable/c/713ba826ae114ab339c9a1b31e209bebdadb0ac9
https://git.kernel.org/stable/c/7a431df418ee6b79841e0b4c7c265a791e3d0a75
https://git.kernel.org/stable/c/8986cdf52f86208df9c7887fee23365b5d37da26
https://git.kernel.org/stable/c/923379f1d7e3af8ccbf11edbbcf41f1bb3e9cfe6
https://git.kernel.org/stable/c/aed58a28ea71a0d7d0947190fab1e3f4daa1d4a5
https://lore.kernel.org/linux-cve-announce/2026021415-CVE-2026-23155-32be@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-23155
https://www.cve.org/CVERecord?id=CVE-2026-23155

History

Sat, 18 Apr 2026 09:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/7a431df418ee6b79841e0b4c7c265a791e3d0a75

Wed, 18 Mar 2026 14:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
CPEs		cpe:2.3:o:linux:linux_kernel:6.12.68:::::::* cpe:2.3:o:linux:linux_kernel:6.18.8:::::::* cpe:2.3:o:linux:linux_kernel:6.19:rc7:::::: cpe:2.3:o:linux:linux_kernel:6.6.122:::::::*
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

Tue, 17 Feb 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026021415-CVE-2026-23155-32be@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-23155 https://www.cve.org/CVERecord?id=CVE-2026-23155
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Sat, 14 Feb 2026 16:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: can: gs_usb: gs_usb_receive_bulk_callback(): fix error message Sinc commit 79a6d1bfe114 ("can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error") a failing resubmit URB will print an info message. In the case of a short read where netdev has not yet been assigned, initialize as NULL to avoid dereferencing an undefined value. Also report the error value of the failed resubmit.
Title		can: gs_usb: gs_usb_receive_bulk_callback(): fix error message
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/494fc029f662c331e06b7c2031deff3c64200eed https://git.kernel.org/stable/c/713ba826ae114ab339c9a1b31e209bebdadb0ac9 https://git.kernel.org/stable/c/8986cdf52f86208df9c7887fee23365b5d37da26 https://git.kernel.org/stable/c/923379f1d7e3af8ccbf11edbbcf41f1bb3e9cfe6 https://git.kernel.org/stable/c/aed58a28ea71a0d7d0947190fab1e3f4daa1d4a5

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-02-14T16:01:22.429Z

Updated: 2026-04-18T08:57:21.313Z

Reserved: 2026-01-13T15:37:45.977Z

Link: CVE-2026-23155

Vulnrichment

No data.

NVD

Status : Modified

Published: 2026-02-14T16:15:55.653

Modified: 2026-04-18T09:16:14.317

Link: CVE-2026-23155

Redhat

Severity : Moderate

Publid Date: 2026-02-14T00:00:00Z

Links: CVE-2026-23155 - Bugzilla

OpenCVE Enrichment

Updated: 2026-04-18T12:30:45Z

Weaknesses

CWE-476

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object