CVE-2026-23307 in Kernel
要約 (英語)
In the Linux kernel, the following vulnerability has been resolved:
can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message
When looking at the data in a USB urb, the actual_length is the size of
the buffer passed to the driver, not the transfer_buffer_length which is
set by the driver as the max size of the buffer.
When parsing the messages in ems_usb_read_bulk_callback() properly check
the size both at the beginning of parsing the message to make sure it is
big enough for the expected structure, and at the end of the message to
make sure we don't overflow past the end of the buffer for the next
message.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
責任者
Linux
予約する
2026年01月13日
公開
2026年03月25日
ステータス
確認済み
エントリ
VulDB provides additional information and datapoints for this CVE:
| 識別子 | 脆弱性 | CWE | 悪用可 | 対策 | CVE |
|---|---|---|---|---|---|
| 353067 | Linux Kernel ems_usb_read_bulk_callback メモリ破損 | 120 | 未定義 | 公式な修正 | CVE-2026-23307 |