CVE-2026-22997

net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts

State: Published
Severity: 7.5 High
Published: Jan 25, 2026
Updated: Oct 19, 2026
Reserved: Jan 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts

Since j1939_session_deactivate_activate_next() in j1939_tp_rxtimer() is called only when the timer is enabled, we need to call j1939_session_deactivate_activate_next() if we cancelled the timer. Otherwise, refcount for j1939_session leaks, which will later appear as

| unregister_netdevice: waiting for vcan0 to become free. Usage count = 2.

problem.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

CWE-772 Missing Release of Resource after Effective Lifetime

Affected Products

Product	Versions
LinuxLinux	9d71dd0c70099914fcd063135da3c580865e924c to before a73e7d7e346dae1c22dc3e95b02ca464b12daf2cAffected 9d71dd0c70099914fcd063135da3c580865e924c to before adabf01c19561e42899da9de56a6a1da0e6b8a5bAffected 9d71dd0c70099914fcd063135da3c580865e924c to before b1d67607e97d489c0cfbbf55f48a76b00710b0e4Affected 9d71dd0c70099914fcd063135da3c580865e924c to before 809a437e27a3bf3c1c6c8c157773635552116f2bAffected 9d71dd0c70099914fcd063135da3c580865e924c to before cb2a610867bc379988bae0bb4b8bbc59c0decf1aAffected 9d71dd0c70099914fcd063135da3c580865e924c to before 6121b7564c725b632ffe4764abe85aa239d37703Affected 9d71dd0c70099914fcd063135da3c580865e924c to before 1809c82aa073a11b7d335ae932d81ce51a588a4aAffected
LinuxLinux	5.4Affected before 5.4Not affected 5.10.249 through 5.10.Not affected 5.15.199 through 5.15.Not affected 6.1.162 through 6.1.Not affected 6.6.122 through 6.6.Not affected 6.12.67 through 6.12.Not affected 6.18.7 through 6.18.Not affected 6.19 and laterNot affected

Product

Versions

LinuxLinux

9d71dd0c70099914fcd063135da3c580865e924c to before a73e7d7e346dae1c22dc3e95b02ca464b12daf2cAffected
9d71dd0c70099914fcd063135da3c580865e924c to before adabf01c19561e42899da9de56a6a1da0e6b8a5bAffected
9d71dd0c70099914fcd063135da3c580865e924c to before b1d67607e97d489c0cfbbf55f48a76b00710b0e4Affected
9d71dd0c70099914fcd063135da3c580865e924c to before 809a437e27a3bf3c1c6c8c157773635552116f2bAffected
9d71dd0c70099914fcd063135da3c580865e924c to before cb2a610867bc379988bae0bb4b8bbc59c0decf1aAffected
9d71dd0c70099914fcd063135da3c580865e924c to before 6121b7564c725b632ffe4764abe85aa239d37703Affected
9d71dd0c70099914fcd063135da3c580865e924c to before 1809c82aa073a11b7d335ae932d81ce51a588a4aAffected

LinuxLinux

5.4Affected
before 5.4Not affected
5.10.249 through 5.10.*Not affected
5.15.199 through 5.15.*Not affected
6.1.162 through 6.1.*Not affected
6.6.122 through 6.6.*Not affected
6.12.67 through 6.12.*Not affected
6.18.7 through 6.18.*Not affected
6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.