When a CAN device sends a message whose length field is zero, the Linux kernel’s ucan driver enters an infinite loop in ucan_read_bulk_callback(), causing the driver to spin forever and potentially hang the system. The flaw is due to insufficient validation of the message length, classifying it under CWE‑606, and because it can lead to an infinite loop (CWE‑835).

The vulnerability affects Linux systems that load the ucan module for USB CAN devices, especially those employing the kvaser_usb driver. Any kernel version released prior to the commit that introduced the fix is susceptible when a faulty or malicious CAN device is connected.

The CVSS base score of 5.5 indicates moderate severity, while an EPSS score below 1% signals a low chance of exploitation in the wild. The likely attack vector is local, inferred from the fact that an attacker would need to plug a compromised or intentionally malformed CAN USB device into the system; it is not remotely reachable and is not listed in CISA’s KEV catalog.