CVE-2026-22997 Details
Description
In the Linux kernel, the following vulnerability has been resolved: net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts Since j1939_session_deactivate_activate_next() in j1939_tp_rxtimer() is called only when the timer is enabled, we need to call j1939_session_deactivate_activate_next() if we cancelled the timer. Otherwise, refcount for j1939_session leaks, which will later appear as | unregister_netdevice: waiting for vcan0 to become free. Usage count = 2. problem.
A vulnerability in the Linux kernel's handling of J1939 sessions can lead to a reference count leak. This issue occurs in the J1939 transport layer when a session is deactivated upon receiving a second Request to Send (RTS) message. The problem arises because the session's deactivation routine is only called when a timer is active. If the timer is canceled, the deactivation routine is skipped, causing the session's reference count to leak. This leak can manifest as a delay in freeing network devices, creating a usage count problem.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been addressed. Instructions for downloading the patched version are available on the Linux kernel's official website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/1809c82aa073a11b7d335ae932d81ce51a588a4a | kernel.org | Patch |
| https://git.kernel.org/stable/c/6121b7564c725b632ffe4764abe85aa239d37703 | kernel.org | Patch |
| https://git.kernel.org/stable/c/809a437e27a3bf3c1c6c8c157773635552116f2b | kernel.org | Patch |
| https://git.kernel.org/stable/c/a73e7d7e346dae1c22dc3e95b02ca464b12daf2c | kernel.org | Patch |
| https://git.kernel.org/stable/c/adabf01c19561e42899da9de56a6a1da0e6b8a5b | kernel.org | Patch |
| https://git.kernel.org/stable/c/b1d67607e97d489c0cfbbf55f48a76b00710b0e4 | kernel.org | Patch |
| https://git.kernel.org/stable/c/cb2a610867bc379988bae0bb4b8bbc59c0decf1a | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.4, < 5.10.249 >= 5.11, < 5.15.199 >= 5.16, < 6.1.162 >= 6.2, < 6.6.122 >= 6.7, < 6.12.67 >= 6.13, < 6.18.7 6.19 rc1 6.19 rc2 6.19 rc3 6.19 rc4 6.19 rc5 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | kernel.org |
| Apr 27, 2026 | CVE Modified | kernel.org |
| Feb 26, 2026 | Initial Analysis | [email protected] |
| Feb 6, 2026 | CVE Modified | kernel.org |
| Jan 30, 2026 | CVE Modified | kernel.org |
| Jan 25, 2026 | New CVE Received | kernel.org |