CVE-2025-38665
can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode
In the Linux kernel, the following vulnerability has been resolved:
can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode
Andrei Lalaev reported a NULL pointer deref when a CAN device is
restarted from Bus Off and the driver does not implement the struct
can_priv::do_set_mode callback.
There are 2 code path that call struct can_priv::do_set_mode:
- directly by a manual restart from the user space, via
can_changelink()
- delayed automatic restart after bus off (deactivated by default)
To prevent the NULL pointer deference, refuse a manual restart or
configure the automatic restart delay in can_changelink() and report
the error via extack to user space.
As an additional safety measure let can_restart() return an error if
can_priv::do_set_mode is not set instead of dereferencing it
unchecked.
Produtos afetados
Linux · LinuxQuer saber se a sua infraestrutura está exposta a isto?
Falar com a TrueHacking →Referências
https://git.kernel.org/stable/c/0ca816a96fdcf32644c80cbe7a82c7b6ce6ddda5https://git.kernel.org/stable/c/6acceb46180f9e160d4f0c56fcaf39ba562822aehttps://git.kernel.org/stable/c/6bbcf37c5114926c99a1d1e6993a5b35689d2599https://git.kernel.org/stable/c/c1f3f9797c1f44a762e6f5f72520b2e520537b52https://git.kernel.org/stable/c/cf81a60a973358dea163f6b14062f17831ceb894https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html