What is CVE-2026-23155?

CVE-2026-23155 is a medium-severity vulnerability in Linux, classified under NULL Pointer Dereference. CVSS score: 5.5/10. Published 2026-02-14.

How severe is CVE-2026-23155?

Medium severity. CVSS v3 base score is 5.5 out of 10.

NULL pointer dereference in Linux

CVE-2026-23155

In the Linux kernel, the following vulnerability has been resolved: can: gs_usb: gs_usb_receive_bulk_callback(): fix error message Sinc commit 79a6d1bfe114 ("can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error") a failing resubmit URB will print an info message. In the case of a short read where netdev has not yet been assigned, initialize as NULL to avoid dereferencing an undefined value. Also report the error value of the failed resubmit.

EPSS: 0.001 (1.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Affected products

Linux — versions da01de754e455e2598a7f1ce4ff2078c4f0ecde1, aa8a8866c533a150be4763bcb27993603bd5426c, ce4352057fc5a986c76ece90801b9755e7c6e56c
Linux Linux_kernel — versions 6.6.122, 6.12.68, 6.18.8

Weakness classification (CWE)

CWE-476 — NULL Pointer Dereference

References

416baaa9-dc9f-4396-8d5f-8c081fb06d67
416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Patch)
416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Patch)
416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Patch)
416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Patch)
416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Patch)

Frequently asked questions

What is CVE-2026-23155?: CVE-2026-23155 is a medium-severity vulnerability in Linux, classified under NULL Pointer Dereference. CVSS score: 5.5/10. Published 2026-02-14.
How severe is CVE-2026-23155?: Medium severity. CVSS v3 base score is 5.5 out of 10.