CVE-2026-23307can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message
- 5.5MediumCVSS base score
- 0.13%Exploitation in 30 daysEPSS · top 97% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message When looking at the data in a USB urb, the actual_length is the size of the buffer passed to the driver, not the transfer_buffer_length which is set by the driver as the max size of the buffer. When parsing the messages in ems_usb_read_bulk_callback() properly check the size both at the beginning of parsing the message to make sure it is big enough for the expected structure, and at the end of the message to make sure we don't overflow past the end of the buffer for the next message.
Timeline
ID reserved
By Linux
- 2 months later
· 2 months later
Published
- 8 months later
· 8 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Analyzed | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.13% · top 97% of all CVEs (15 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.
Affected products
- affected 702171adeed3607ee9603ec30ce081411e36ae42 – < aed172a2e2330131f0977d2acd3ec8883f413ec1
- affected 702171adeed3607ee9603ec30ce081411e36ae42 – < f10177e6c4575aedaea580ce67d792fab7a2235e
- affected 702171adeed3607ee9603ec30ce081411e36ae42 – < c703bbf8e9b4947e111c88d2ed09236a6772a471
- affected 702171adeed3607ee9603ec30ce081411e36ae42 – < 1818974e1b5ef200e27f144c8cb8a246420bb54d
- affected 702171adeed3607ee9603ec30ce081411e36ae42 – < 18f75b9cbdc3703f15965425ab69dee509b07785
- affected 702171adeed3607ee9603ec30ce081411e36ae42 – < 1cf469026d4a2308eaa91d04dca4a900d07a5c2e
- affected 702171adeed3607ee9603ec30ce081411e36ae42 – < 2833e13e2b099546abf5d40a483b4eb04ddd1f7b
- affected 702171adeed3607ee9603ec30ce081411e36ae42 – < 38a01c9700b0dcafe97dfa9dc7531bf4a245deff
- affected 2.6.32
- unaffected < 2.6.32
- unaffected 5.10.253 – ≤ 5.10.*
- unaffected 5.15.203 – ≤ 5.15.*
- unaffected 6.1.167 – ≤ 6.1.*
- unaffected 6.6.130 – ≤ 6.6.*
- unaffected 6.12.77 – ≤ 6.12.*
- unaffected 6.18.17 – ≤ 6.18.*
- unaffected 6.19.7 – ≤ 6.19.*
- unaffected 7.0 – ≤ *
References
References8
- https://git.kernel.org/stable/c/aed172a2e2330131f0977d2acd3ec8883f413ec1 (opens in a new tab)
- https://git.kernel.org/stable/c/f10177e6c4575aedaea580ce67d792fab7a2235e (opens in a new tab)
- https://git.kernel.org/stable/c/c703bbf8e9b4947e111c88d2ed09236a6772a471 (opens in a new tab)
- https://git.kernel.org/stable/c/1818974e1b5ef200e27f144c8cb8a246420bb54d (opens in a new tab)
- https://git.kernel.org/stable/c/18f75b9cbdc3703f15965425ab69dee509b07785 (opens in a new tab)
- https://git.kernel.org/stable/c/1cf469026d4a2308eaa91d04dca4a900d07a5c2e (opens in a new tab)
- https://git.kernel.org/stable/c/2833e13e2b099546abf5d40a483b4eb04ddd1f7b (opens in a new tab)
- https://git.kernel.org/stable/c/38a01c9700b0dcafe97dfa9dc7531bf4a245deff (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-15248 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-23307)Record last updated .