CVE-2026-23357

can: mcp251x: fix deadlock in error path of mcp251x_open

State: Published
Severity: Not scored
Published: Mar 25, 2026
Updated: Oct 15, 2026
Reserved: Jan 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

can: mcp251x: fix deadlock in error path of mcp251x_open

The mcp251x_open() function call free_irq() in its error path with the mpc_lock mutex held. But if an interrupt already occurred the interrupt handler will be waiting for the mpc_lock and free_irq() will deadlock waiting for the handler to finish.

This issue is similar to the one fixed in commit 7dd9c26bd6cf ("can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open") but for the error path.

To solve this issue move the call to free_irq() after the lock is released. Setting `priv->force_quit = 1` beforehand ensure that the IRQ handler will exit right away once it acquired the lock.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	bf66f3736a945dd4e92d86427276c6eeab0a6c1d to before 739454057572cb0948658d1142f3fa2c6966465cAffected bf66f3736a945dd4e92d86427276c6eeab0a6c1d to before 416c18ecddafab0ed09be1e7b9d2f448f3d4db16Affected bf66f3736a945dd4e92d86427276c6eeab0a6c1d to before 256f0cff6e946c570392bda1d01a65e789a7afd0Affected bf66f3736a945dd4e92d86427276c6eeab0a6c1d to before b73832292cd914e87a55e863ba4413a907e7db6bAffected bf66f3736a945dd4e92d86427276c6eeab0a6c1d to before 38063cc435b69d56e76f947c10d336fcb2953508Affected bf66f3736a945dd4e92d86427276c6eeab0a6c1d to before d27f12c3f5e85efc479896af4a69eccb37f75e8eAffected bf66f3736a945dd4e92d86427276c6eeab0a6c1d to before e728f444c913a91d290d1824b4770780bbd6378eAffected bf66f3736a945dd4e92d86427276c6eeab0a6c1d to before ab3f894de216f4a62adc3b57e9191888cbf26885Affected
LinuxLinux	2.6.34Affected before 2.6.34Not affected 5.10.253 through 5.10.Not affected 5.15.203 through 5.15.Not affected 6.1.167 through 6.1.Not affected 6.6.130 through 6.6.Not affected 6.12.77 through 6.12.Not affected 6.18.17 through 6.18.Not affected 6.19.7 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

bf66f3736a945dd4e92d86427276c6eeab0a6c1d to before 739454057572cb0948658d1142f3fa2c6966465cAffected
bf66f3736a945dd4e92d86427276c6eeab0a6c1d to before 416c18ecddafab0ed09be1e7b9d2f448f3d4db16Affected
bf66f3736a945dd4e92d86427276c6eeab0a6c1d to before 256f0cff6e946c570392bda1d01a65e789a7afd0Affected
bf66f3736a945dd4e92d86427276c6eeab0a6c1d to before b73832292cd914e87a55e863ba4413a907e7db6bAffected
bf66f3736a945dd4e92d86427276c6eeab0a6c1d to before 38063cc435b69d56e76f947c10d336fcb2953508Affected
bf66f3736a945dd4e92d86427276c6eeab0a6c1d to before d27f12c3f5e85efc479896af4a69eccb37f75e8eAffected
bf66f3736a945dd4e92d86427276c6eeab0a6c1d to before e728f444c913a91d290d1824b4770780bbd6378eAffected
bf66f3736a945dd4e92d86427276c6eeab0a6c1d to before ab3f894de216f4a62adc3b57e9191888cbf26885Affected

LinuxLinux

2.6.34Affected
before 2.6.34Not affected
5.10.253 through 5.10.*Not affected
5.15.203 through 5.15.*Not affected
6.1.167 through 6.1.*Not affected
6.6.130 through 6.6.*Not affected
6.12.77 through 6.12.*Not affected
6.18.17 through 6.18.*Not affected
6.19.7 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.