The f81604 CAN USB driver in the Linux kernel was found to accept interrupt URBs that were shorter than expected without proper validation. Because the driver treats the truncated data as valid, it can read beyond allocated buffers, potentially corrupting kernel memory. This flaw is identified as CWE‑131 and can lead to a kernel crash, compromising the availability of the system and possibly affecting confidentiality and integrity if an attacker can read corrupted data.

All Linux kernel installations that include the f81604 CAN USB driver before the patch commits are affected. The advisory does not list specific kernel releases, so any build of the kernel containing the driver prior to the referenced commits may be vulnerable. Updated kernels incorporating those commits are expected to be protected.

The likelihood of exploitation is low, with an EPSS score below 1% and no listing in the CISA KEV catalog. Exploitation would require physical or local access to a USB device that routes through the vulnerable driver. If an attacker can supply crafted USB traffic, the flaw could be used to cause a denial‑of‑service or memory corruption but is unlikely to provide remote code execution.