NetSight
IP …
high7.5

CVE-2026-22997

In the Linux kernel, the following vulnerability has been resolved: net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the s…

Impact

In the Linux kernel, the following vulnerability has been resolved: net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts Since j1939_session_deactivate_activate_next() in j1939_tp_rxtimer() is called only when the timer is enabled, we need to call j1939_session_deactivate_activate_next() if we cancelled the timer. Otherwise, refcount for j1939_session leaks, which will later appear as | unregister_netdevice: waiting for vcan0 to become free. Usage count = 2. problem.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 5.4 before 5.10.249
from 5.11 before 5.15.199
from 5.16 before 6.1.162
from 6.2 before 6.6.122
from 6.7 before 6.12.67
from 6.13 before 6.18.7

Weakness classification

CWE-772

References