Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In the Linux kernel, the following vulnerability has been resolved: can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message When looking at the data in a USB urb, the actual_length is the size of the buffer passed to the driver, not the transfer_buffer_length which is set by the driver as the max size of the buffer. When parsing the messages in ems_usb_read_bulk_callback() properly check the size both at the beginning of parsing the message to make sure it is big enough for the expected structure, and at the end of the message to make sure we don't overflow past the end of the buffer for the next message.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-03-25 | 2 | Disclosure1Patch1 |
| 2026-03-28 | 1 | General1 |
CVE-2026-23307 In the Linux kernel, the following vulnerability has been resolved: can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message When looking at… https://www.cve.org/CVERecord?id=CVE-2026-23307
Post summary
CVE-2026-23307 is a length-check issue in the Linux kernel's ems_usb driver that has been fixed; a patch is available and no active exploitation or PoC is reported.
⚡ New CVE Alert: CVE-2026-23307 🚨 Risk Level: Unknown 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-23307 #CVE-2026-23307 #CVE #CyberSecurity #InfoSec https://t.co/DbRPNUtNcK
Post summary
The tweet announces CVE-2026-23307 but provides no technical details, exploits, or mitigation information.
🚨*CVE* CVE-2026-23307 In the Linux kernel, the following vulnerability has been resolved: can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message When looking at… https://www.cve.org/CVERecord?id=CVE-2026-23307 ----- Traducción: CVE-2026-23307 En … http://infoflow.cloud`
Post summary
The text announces that CVE-2026-23307 in the Linux kernel has been resolved, providing a link to the CVE record but no further technical or exploit details.
3 of 3 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | linux | linux_kernel | - | - | - |
| OS | linux | linux_kernel | 7.0 | - | - |
| OS | linux | linux_kernel | 7.0 | - | - |