CVE-2026-23334 json
can: usb: f81604: handle short interrupt urb messages properly
published 2026-03-25 7 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-15295
- cvss
- 5.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.1%
- EPSS 0.1% chance of exploitation in 30 days, percentile 2%
- public exploits
- 0
- none known
Summary
In the Linux kernel, the following vulnerability has been resolved:
can: usb: f81604: handle short interrupt urb messages properly
If an interrupt urb is received that is not the correct length, properly detect it and don't attempt to treat the data as valid.
Patch / fix
- Linux Linux 6.6.130, 6.12.77, 6.18.17, 6.19.7, 7.0
- linux Debian 13 6.12.85-1
- linux Debian 14 6.19.8-1
debian advisories DEBIAN-CVE-2026-23334
- linux Ubuntu 24.04 LTS 6.8.0-136.136
- linux-aws Ubuntu 24.04 LTS 6.8.0-1061.64
- linux-gcp Ubuntu 24.04 LTS 6.8.0-1064.72
- linux-gke Ubuntu 24.04 LTS 6.8.0-1059.67
- linux-ibm Ubuntu 24.04 LTS 6.8.0-1061.62
- linux-azure Ubuntu 24.04 LTS 6.8.0-1063.71
- linux-gkeop Ubuntu 24.04 LTS 6.8.0-1046.50
- linux-raspi Ubuntu 24.04 LTS 6.8.0-1061.65
ubuntu advisories UBUNTU-CVE-2026-23334
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- kernel-syms Linux Micro Extras 6.2 6.12.0-160000.33.1
- kernel-obs-build Linux Micro Extras 6.2 6.12.0-160000.33.1
suse advisories SUSE-SU-2026:21834-1
- git.kernel.org/stable/c/9b740ff5bc649575a5e14ca8ee54e3dd5010aaf0 commit
- git.kernel.org/stable/c/c5d69da6c919648838734097861e979677eedcde commit
- git.kernel.org/stable/c/36ead57443146e6b730ce1f48ca3e9b17e19a3d2 commit
- git.kernel.org/stable/c/66615e6293388f75a56226d1216fd9cfb3d95e05 commit
- git.kernel.org/stable/c/7299b1b39a255f6092ce4ec0b65f66e9d6a357af commit
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-23334 updated
kernel: can: usb: f81604: handle short interrupt urb messages properly
-
Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more Red Hat Enterprise Linux 10 kernelnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
0.13% chance of exploitation in the next 30 days, higher than 2% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Affected products
- Linux Linux
Classification
- Technology feeds
References
-
git.kernel.org
/stable/c/9b740ff5bc649575a5e14ca8ee54e3dd5010aaf0
patch
-
git.kernel.org
/stable/c/c5d69da6c919648838734097861e979677eedcde
patch
-
git.kernel.org
/stable/c/36ead57443146e6b730ce1f48ca3e9b17e19a3d2
patch
-
git.kernel.org
/stable/c/66615e6293388f75a56226d1216fd9cfb3d95e05
patch
-
git.kernel.org
/stable/c/7299b1b39a255f6092ce4ec0b65f66e9d6a357af
patch
Sources
- CVE List CVE-2026-23334
- NVD CVE-2026-23334
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.