Executive brief
A vulnerability was identified in the Linux kernel's EMS CPC-USB CAN interface driver. This driver is used to manage communication with specific USB-to-CAN hardware adapters often found in industrial or automotive environments. An exploit could allow a local user to cause a system crash or denial of service by sending malformed messages that trigger a memory buffer overflow.
Technical details
A vulnerability exists in the ems_usb_read_bulk_callback() function within drivers/net/can/usb/ems_usb.c of the Linux kernel. The driver incorrectly used transfer_buffer_length (the maximum possible size) instead of actual_length (the size of data actually received) when validating USB Request Block (URB) data. This lack of strict bounds checking during message parsing allows for a potential buffer overflow when processing sequences of messages. An attacker with local access could exploit this to cause a kernel panic (Denial of Service). The fix introduces explicit checks at both the start and end of message parsing to ensure the data fits within the actual received buffer.
Affected products
- Linux Linux Kernel 2.6.32 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.77, 6.13 to 6.18.17, 6.19 to 6.19.7, 7.0-rc1, 7.0-rc2
Timeline
- 2026-03-25: disclosed
- 2026-03-25: advisory
- 2026-03-25: patched
References
- https://git.kernel.org/stable/c/1818974e1b5ef200e27f144c8cb8a246420bb54d
- https://git.kernel.org/stable/c/18f75b9cbdc3703f15965425ab69dee509b07785
- https://git.kernel.org/stable/c/1cf469026d4a2308eaa91d04dca4a900d07a5c2e
- https://git.kernel.org/stable/c/2833e13e2b099546abf5d40a483b4eb04ddd1f7b
- https://git.kernel.org/stable/c/38a01c9700b0dcafe97dfa9dc7531bf4a245deff
- https://git.kernel.org/stable/c/aed172a2e2330131f0977d2acd3ec8883f413ec1
- https://git.kernel.org/stable/c/c703bbf8e9b4947e111c88d2ed09236a6772a471