The vulnerability appears in the mcp251x CAN controller driver in the Linux kernel. During an error path in the mcp251x_open function, the driver calls free_irq while holding the mpc_lock mutex. If an interrupt has already occurred, the handler waits for the same mutex, resulting in a deadlock that stalls the kernel. This can lead to a denial‑of‑service condition, potentially making the system unresponsive or requiring a reboot. The weakness falls under CWEs that involve deadlocks (CWE‑833).

The affected system is the Linux kernel. No specific kernel version numbers are listed in the available data, so any kernel that includes the mcp251x CAN driver before it was patched is potentially vulnerable. Users should verify whether their kernel contains the commit that introduced the fix or have performed a recent kernel update.

The CVSS base score of 5.5 indicates moderate severity. EPSS shows a probability of less than 1 %, and the vulnerability is not listed in CISA’s KEV catalog, suggesting it is not widely exploited. Attack vectors that can exploit this vulnerability appear to require local or privileged access to trigger the driver during a failing open operation, so it is not a remote exploit. Nevertheless, a local attacker who can manipulate the CAN controller could potentially cause the kernel to stall if the device generates an interrupt while the driver is trying to release its IRQ resources.