CVE-2026-46103: Linux Kernel CAN UCAN Driver Vulnerability

CVE-2026-46103 Overview

CVE-2026-46103 is a Linux kernel vulnerability in the ucan Controller Area Network (CAN) USB driver. The flaw stems from incorrect device-managed resource (devres) lifetime handling, where allocations were tied to the parent USB device rather than the USB interface. When the driver unbinds without physical disconnection — such as during probe deferral or USB configuration changes — the control message buffer is not released, resulting in a memory leak. The issue has been resolved upstream by ensuring the buffer lifetime is correctly tied to the USB interface so resources are freed on driver unbind.

Critical Impact
Repeated driver unbind cycles on systems using ucan-compatible USB CAN adapters can exhaust kernel memory, leading to degraded system stability and potential denial of service.

Affected Products

Linux kernel — drivers/net/can/usb/ucan.c driver
Systems using USB CAN adapters supported by the ucan driver
Kernel branches receiving stable backports referenced in the upstream commits

Discovery Timeline

2026-05-27 - CVE CVE-2026-46103 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46103

Vulnerability Analysis

The Linux kernel exposes device-managed resource helpers (the devres family, such as devm_kmalloc) that automatically release allocations when a driver is unbound from a device. USB drivers bind to USB interfaces, not to the parent USB device. When devres allocations are anchored to the parent USB device, the kernel will not free them at driver unbind time. The resources are only freed when the USB device itself is removed.

In the ucan CAN-over-USB driver, the control message buffer was allocated against the parent USB device. As a result, every unbind-rebind cycle that did not involve physical disconnection leaked the previously allocated buffer. Probe deferral and USB configuration changes are common, non-malicious triggers for this code path.

The class of defect maps to a Memory Leak (resource lifetime mismanagement). It does not provide code execution or privilege escalation primitives, but it does degrade kernel memory availability over time on long-running systems with CAN hardware.

Root Cause

The root cause is an incorrect parent device argument passed to the devres allocator for the control message buffer. The driver associated the allocation with the USB device structure rather than the USB interface structure that the driver actually binds to. This breaks the assumption that devres cleanup runs at driver unbind.

Attack Vector

This is a local, hardware-dependent issue. Triggering the leak requires repeated bind/unbind cycles of the ucan driver against an attached USB CAN adapter, or repeated probe deferrals during boot. There is no known network-reachable attack vector and no public proof of concept.

Detection Methods for CVE-2026-46103

Indicators of Compromise

Growth in Slab or kmalloc-* counters in /proc/meminfo and /proc/slabinfo on hosts using USB CAN adapters
Repeated ucan probe, unbind, or probe-deferral messages in dmesg without corresponding memory reclamation
Long-uptime hosts with CAN adapters showing unexplained kernel memory growth

Detection Strategies

Compare running kernel version and ucan driver commit against the fixed commits referenced in the upstream patches
Use kmemleak (CONFIG_DEBUG_KMEMLEAK=y) on test systems to confirm leaked allocations originating from the ucan probe path
Audit endpoints and embedded Linux devices for the ucan module via lsmod | grep ucan and inventory affected hardware

Monitoring Recommendations

Track kernel slab usage trends on industrial, automotive, and embedded Linux systems that interface with CAN hardware
Alert on abnormal frequencies of ucan driver bind/unbind events in system logs
Include kernel package versions in configuration management baselines so unpatched hosts are flagged automatically

How to Mitigate CVE-2026-46103

Immediate Actions Required

Inventory Linux systems that load the ucan module and prioritize patching of long-running or production CAN endpoints
Apply the stable kernel updates referenced in the upstream commits as soon as they are available from your distribution
Reboot affected systems after patching to clear any leaked memory accumulated under the vulnerable driver

Patch Information

The fix changes the control message buffer allocation so its lifetime is tied to the USB interface, ensuring release at driver unbind. Refer to the upstream commits: Kernel commit 10b7b676b78a, Kernel commit 4b7d07747400, Kernel commit c0d3ccc6929e, Kernel commit c524c124e309, and Kernel commit fed4626501c8.

Workarounds

Avoid repeated manual unbind and rebind of the ucan driver on unpatched kernels
Blacklist the ucan module on systems that do not require CAN-over-USB support until patches are applied
Schedule periodic reboots on long-running unpatched systems to reclaim leaked kernel memory