1. Home
  2. Vulnerabilities
  3. CVE-2026-23357
5.5
MEDIUM CVSS 3.1
CVE-2026-23357
can: mcp251x: fix deadlock in error path of mcp251x_open
Overview
Description

In the Linux kernel, the following vulnerability has been resolved: can: mcp251x: fix deadlock in error path of mcp251x_open The mcp251x_open() function call free_irq() in its error path with the mpc_lock mutex held. But if an interrupt already occurred the interrupt handler will be waiting for the mpc_lock and free_irq() will deadlock waiting for the handler to finish. This issue is similar to the one fixed in commit 7dd9c26bd6cf ("can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open") but for the error path. To solve this issue move the call to free_irq() after the lock is released. Setting `priv->force_quit = 1` beforehand ensure that the IRQ handler will exit right away once it acquired the lock.

Details
INFO

Published Date :

March 25, 2026, 11:16 a.m.

Last Modified :

April 24, 2026, 7:04 p.m.

Remotely Exploit :

No

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Impact
Affected Products

The following products are affected by CVE-2026-23357 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Linux linux_kernel
: Total Affected Vendor : 1 | Products : 1
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 3.1 MEDIUM [email protected]
Solution
Resolve deadlock by moving free_irq() call after lock release and setting force_quit.
  • Move free_irq() call after lock release.
  • Set priv->force_quit = 1 before releasing lock.
Public PoC/Exploit Available at Github

CVE-2026-23357 has a 1 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-23357.

URL Resource
https://git.kernel.org/stable/c/256f0cff6e946c570392bda1d01a65e789a7afd0 Patch
https://git.kernel.org/stable/c/38063cc435b69d56e76f947c10d336fcb2953508 Patch
https://git.kernel.org/stable/c/416c18ecddafab0ed09be1e7b9d2f448f3d4db16 Patch
https://git.kernel.org/stable/c/739454057572cb0948658d1142f3fa2c6966465c Patch
https://git.kernel.org/stable/c/ab3f894de216f4a62adc3b57e9191888cbf26885 Patch
https://git.kernel.org/stable/c/b73832292cd914e87a55e863ba4413a907e7db6b Patch
https://git.kernel.org/stable/c/d27f12c3f5e85efc479896af4a69eccb37f75e8e Patch
https://git.kernel.org/stable/c/e728f444c913a91d290d1824b4770780bbd6378e Patch
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-23357 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-23357 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Profile Photo
w4zu/Debian_security

DSA and DLA for Debian last 14 days

Python

Updated: 10 hours, 36 minutes ago
0 stars 1 fork 1 watcher
Born at : Feb. 12, 2025, 2:08 p.m. This repo has been linked 606 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-23357 vulnerability anywhere in the article.

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2026-23357 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • Initial Analysis by [email protected]

    Apr. 24, 2026

    Action Type Old Value New Value
    Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
    Added CWE CWE-667
    Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:2.6.34:-:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 6.19.7 *cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.17 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.130 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.77 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.203 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.167 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 2.6.34.1 up to (excluding) 5.10.253
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/256f0cff6e946c570392bda1d01a65e789a7afd0 Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/38063cc435b69d56e76f947c10d336fcb2953508 Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/416c18ecddafab0ed09be1e7b9d2f448f3d4db16 Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/739454057572cb0948658d1142f3fa2c6966465c Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/ab3f894de216f4a62adc3b57e9191888cbf26885 Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/b73832292cd914e87a55e863ba4413a907e7db6b Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/d27f12c3f5e85efc479896af4a69eccb37f75e8e Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/e728f444c913a91d290d1824b4770780bbd6378e Types: Patch
  • CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Apr. 18, 2026

    Action Type Old Value New Value
    Added Reference https://git.kernel.org/stable/c/416c18ecddafab0ed09be1e7b9d2f448f3d4db16
    Added Reference https://git.kernel.org/stable/c/739454057572cb0948658d1142f3fa2c6966465c
  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Mar. 25, 2026

    Action Type Old Value New Value
    Added Description In the Linux kernel, the following vulnerability has been resolved: can: mcp251x: fix deadlock in error path of mcp251x_open The mcp251x_open() function call free_irq() in its error path with the mpc_lock mutex held. But if an interrupt already occurred the interrupt handler will be waiting for the mpc_lock and free_irq() will deadlock waiting for the handler to finish. This issue is similar to the one fixed in commit 7dd9c26bd6cf ("can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open") but for the error path. To solve this issue move the call to free_irq() after the lock is released. Setting `priv->force_quit = 1` beforehand ensure that the IRQ handler will exit right away once it acquired the lock.
    Added Reference https://git.kernel.org/stable/c/256f0cff6e946c570392bda1d01a65e789a7afd0
    Added Reference https://git.kernel.org/stable/c/38063cc435b69d56e76f947c10d336fcb2953508
    Added Reference https://git.kernel.org/stable/c/ab3f894de216f4a62adc3b57e9191888cbf26885
    Added Reference https://git.kernel.org/stable/c/b73832292cd914e87a55e863ba4413a907e7db6b
    Added Reference https://git.kernel.org/stable/c/d27f12c3f5e85efc479896af4a69eccb37f75e8e
    Added Reference https://git.kernel.org/stable/c/e728f444c913a91d290d1824b4770780bbd6378e
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CVSS
Vulnerability Scoring Details
Base CVSS Score: 5.5
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact