In the Linux kernel, the following vulnerability has been resolved:
can: netlink: canchangelink(): fix NULL pointer deref of struct canpriv::dosetmode
Andrei Lalaev reported a NULL pointer deref when a CAN device is restarted from Bus Off and the driver does not implement the struct canpriv::doset_mode callback.
There are 2 code path that call struct canpriv::dosetmode: - directly by a manual restart from the user space, via canchangelink() - delayed automatic restart after bus off (deactivated by default)
To prevent the NULL pointer deference, refuse a manual restart or configure the automatic restart delay in can_changelink() and report the error via extack to user space.
As an additional safety measure let canrestart() return an error if canpriv::dosetmode is not set instead of dereferencing it unchecked.
[ { "deprecated": false, "digest": { "line_hashes": [ "124872885127474908693974638268981038124", "217939689743117838756805643262440599418", "233968603977748773654489088371244291139", "279620314014585599414782050031018636815", "92828297381857719808518811736670721470", "97193902919396231048726004017930740685", "214212848302327897308073668849784757361", "31050427929594297039615554271014414440", "314241280548713211862807110204329393121", "57575103651222150509814457969913512780", "316896714463549546515471706705496801239", "91497817132972580002012994215421059342", "93650495709941309928587032116205851538", "239366991486651847400442052197302214855", "6589136892238685228284471114207555656", "200958411480217458699564219340712864357", "82866874222804369496422654998811682425", "192723010879275460090840901347798288963", "4104251293302371158293528275467990413", "99511412315351717359399337255760802164", "302751797180543245051016195316398885469", "323471583634480048308817122283371712665" ], "threshold": 0.9 }, "signature_type": "Line", "target": { "file": "drivers/net/can/dev/dev.c" }, "id": "CVE-2025-38665-08a94175", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c1f3f9797c1f44a762e6f5f72520b2e520537b52", "signature_version": "v1" }, { "deprecated": false, "digest": { "length": 3953.0, "function_hash": "249180819659891154353799249653974136923" }, "signature_type": "Function", "target": { "file": "drivers/net/can/dev/netlink.c", "function": "can_changelink" }, "id": "CVE-2025-38665-25bce04c", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c1f3f9797c1f44a762e6f5f72520b2e520537b52", "signature_version": "v1" }, { "deprecated": false, "digest": { "length": 620.0, "function_hash": "40968664299607619706412846533154184946" }, "signature_type": "Function", "target": { "file": "drivers/net/can/dev/dev.c", "function": "can_restart" }, "id": "CVE-2025-38665-265ce31a", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cf81a60a973358dea163f6b14062f17831ceb894", "signature_version": "v1" }, { "deprecated": false, "digest": { "length": 3868.0, "function_hash": "216194316129519015704995399310011552796" }, "signature_type": "Function", "target": { "file": "drivers/net/can/dev/netlink.c", "function": "can_changelink" }, "id": "CVE-2025-38665-30ed91b2", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6acceb46180f9e160d4f0c56fcaf39ba562822ae", "signature_version": "v1" }, { "deprecated": false, "digest": { "length": 241.0, "function_hash": "297833769956012656914742280566819677666" }, "signature_type": "Function", "target": { "file": "drivers/net/can/dev/dev.c", "function": "can_restart_now" }, "id": "CVE-2025-38665-4312688a", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c1f3f9797c1f44a762e6f5f72520b2e520537b52", "signature_version": "v1" }, { "deprecated": false, "digest": { "line_hashes": [ "124872885127474908693974638268981038124", "217939689743117838756805643262440599418", "233968603977748773654489088371244291139", "279620314014585599414782050031018636815", "92828297381857719808518811736670721470", "97193902919396231048726004017930740685", "214212848302327897308073668849784757361", "31050427929594297039615554271014414440", "314241280548713211862807110204329393121", "57575103651222150509814457969913512780", "316896714463549546515471706705496801239", "91497817132972580002012994215421059342", "93650495709941309928587032116205851538", "239366991486651847400442052197302214855", "6589136892238685228284471114207555656", "200958411480217458699564219340712864357", "82866874222804369496422654998811682425", "192723010879275460090840901347798288963", "4104251293302371158293528275467990413", "99511412315351717359399337255760802164", "302751797180543245051016195316398885469", "323471583634480048308817122283371712665" ], "threshold": 0.9 }, "signature_type": "Line", "target": { "file": "drivers/net/can/dev/dev.c" }, "id": "CVE-2025-38665-4ea69efe", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cf81a60a973358dea163f6b14062f17831ceb894", "signature_version": "v1" }, { "deprecated": false, "digest": { "line_hashes": [ "124872885127474908693974638268981038124", "217939689743117838756805643262440599418", "233968603977748773654489088371244291139", "279620314014585599414782050031018636815", "92828297381857719808518811736670721470", "97193902919396231048726004017930740685", "214212848302327897308073668849784757361", "31050427929594297039615554271014414440", "314241280548713211862807110204329393121", "57575103651222150509814457969913512780", "316896714463549546515471706705496801239", "91497817132972580002012994215421059342", "93650495709941309928587032116205851538", "239366991486651847400442052197302214855", "6589136892238685228284471114207555656", "200958411480217458699564219340712864357", "82866874222804369496422654998811682425", "192723010879275460090840901347798288963", "4104251293302371158293528275467990413", "99511412315351717359399337255760802164", "302751797180543245051016195316398885469", "323471583634480048308817122283371712665" ], "threshold": 0.9 }, "signature_type": "Line", "target": { "file": "drivers/net/can/dev/dev.c" }, "id": "CVE-2025-38665-513c8adc", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0ca816a96fdcf32644c80cbe7a82c7b6ce6ddda5", "signature_version": "v1" }, { "deprecated": false, "digest": { "line_hashes": [ "212935876875138213374378540937962986671", "201005658758910484060393075955960657357", "170188525157207435629014269226293727313", "146023379445608895367282226963273564098", "127015060221764579149250872859977492053", "8152680011096060708744070511894525884", "25701752523623369805577184256834568280", "57773571300944415166867789941509140144" ], "threshold": 0.9 }, "signature_type": "Line", "target": { "file": "drivers/net/can/dev/netlink.c" }, "id": "CVE-2025-38665-5d49792d", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0ca816a96fdcf32644c80cbe7a82c7b6ce6ddda5", "signature_version": "v1" }, { "deprecated": false, "digest": { "length": 620.0, "function_hash": "40968664299607619706412846533154184946" }, "signature_type": "Function", "target": { "file": "drivers/net/can/dev/dev.c", "function": "can_restart" }, "id": "CVE-2025-38665-6e540a0a", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c1f3f9797c1f44a762e6f5f72520b2e520537b52", "signature_version": "v1" }, { "deprecated": false, "digest": { "length": 620.0, "function_hash": "40968664299607619706412846533154184946" }, "signature_type": "Function", "target": { "file": "drivers/net/can/dev/dev.c", "function": "can_restart" }, "id": "CVE-2025-38665-70e3ffdc", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6acceb46180f9e160d4f0c56fcaf39ba562822ae", "signature_version": "v1" }, { "deprecated": false, "digest": { "length": 3810.0, "function_hash": "181991567613757313545603702389467792917" }, "signature_type": "Function", "target": { "file": "drivers/net/can/dev/netlink.c", "function": "can_changelink" }, "id": "CVE-2025-38665-7b5f798f", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6bbcf37c5114926c99a1d1e6993a5b35689d2599", "signature_version": "v1" }, { "deprecated": false, "digest": { "length": 241.0, "function_hash": "297833769956012656914742280566819677666" }, "signature_type": "Function", "target": { "file": "drivers/net/can/dev/dev.c", "function": "can_restart_now" }, "id": "CVE-2025-38665-7ed5724a", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0ca816a96fdcf32644c80cbe7a82c7b6ce6ddda5", "signature_version": "v1" }, { "deprecated": false, "digest": { "line_hashes": [ "212935876875138213374378540937962986671", "201005658758910484060393075955960657357", "170188525157207435629014269226293727313", "146023379445608895367282226963273564098", "127015060221764579149250872859977492053", "8152680011096060708744070511894525884", "25701752523623369805577184256834568280", "57773571300944415166867789941509140144" ], "threshold": 0.9 }, "signature_type": "Line", "target": { "file": "drivers/net/can/dev/netlink.c" }, "id": "CVE-2025-38665-83733434", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cf81a60a973358dea163f6b14062f17831ceb894", "signature_version": "v1" }, { "deprecated": false, "digest": { "length": 620.0, "function_hash": "40968664299607619706412846533154184946" }, "signature_type": "Function", "target": { "file": "drivers/net/can/dev/dev.c", "function": "can_restart" }, "id": "CVE-2025-38665-84229cb6", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6bbcf37c5114926c99a1d1e6993a5b35689d2599", "signature_version": "v1" }, { "deprecated": false, "digest": { "length": 3868.0, "function_hash": "216194316129519015704995399310011552796" }, "signature_type": "Function", "target": { "file": "drivers/net/can/dev/netlink.c", "function": "can_changelink" }, "id": "CVE-2025-38665-9c9c4338", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0ca816a96fdcf32644c80cbe7a82c7b6ce6ddda5", "signature_version": "v1" }, { "deprecated": false, "digest": { "line_hashes": [ "212935876875138213374378540937962986671", "201005658758910484060393075955960657357", "170188525157207435629014269226293727313", "146023379445608895367282226963273564098", "127015060221764579149250872859977492053", "8152680011096060708744070511894525884", "25701752523623369805577184256834568280", "57773571300944415166867789941509140144" ], "threshold": 0.9 }, "signature_type": "Line", "target": { "file": "drivers/net/can/dev/netlink.c" }, "id": "CVE-2025-38665-a5168276", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c1f3f9797c1f44a762e6f5f72520b2e520537b52", "signature_version": "v1" }, { "deprecated": false, "digest": { "length": 241.0, "function_hash": "297833769956012656914742280566819677666" }, "signature_type": "Function", "target": { "file": "drivers/net/can/dev/dev.c", "function": "can_restart_now" }, "id": "CVE-2025-38665-a64ee79f", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cf81a60a973358dea163f6b14062f17831ceb894", "signature_version": "v1" }, { "deprecated": false, "digest": { "length": 241.0, "function_hash": "297833769956012656914742280566819677666" }, "signature_type": "Function", "target": { "file": "drivers/net/can/dev/dev.c", "function": "can_restart_now" }, "id": "CVE-2025-38665-b2d8705f", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6acceb46180f9e160d4f0c56fcaf39ba562822ae", "signature_version": "v1" }, { "deprecated": false, "digest": { "line_hashes": [ "132364512970370532113861230153256308021", "120301805644430222381928502750559789808", "170188525157207435629014269226293727313", "146023379445608895367282226963273564098", "127015060221764579149250872859977492053", "8152680011096060708744070511894525884", "25701752523623369805577184256834568280", "57773571300944415166867789941509140144" ], "threshold": 0.9 }, "signature_type": "Line", "target": { "file": "drivers/net/can/dev/netlink.c" }, "id": "CVE-2025-38665-b2fb0597", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6bbcf37c5114926c99a1d1e6993a5b35689d2599", "signature_version": "v1" }, { "deprecated": false, "digest": { "length": 620.0, "function_hash": "40968664299607619706412846533154184946" }, "signature_type": "Function", "target": { "file": "drivers/net/can/dev/dev.c", "function": "can_restart" }, "id": "CVE-2025-38665-b90b6762", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0ca816a96fdcf32644c80cbe7a82c7b6ce6ddda5", "signature_version": "v1" }, { "deprecated": false, "digest": { "line_hashes": [ "124872885127474908693974638268981038124", "217939689743117838756805643262440599418", "233968603977748773654489088371244291139", "279620314014585599414782050031018636815", "92828297381857719808518811736670721470", "97193902919396231048726004017930740685", "214212848302327897308073668849784757361", "31050427929594297039615554271014414440", "314241280548713211862807110204329393121", "57575103651222150509814457969913512780", "316896714463549546515471706705496801239", "91497817132972580002012994215421059342", "93650495709941309928587032116205851538", "239366991486651847400442052197302214855", "6589136892238685228284471114207555656", "200958411480217458699564219340712864357", "82866874222804369496422654998811682425", "192723010879275460090840901347798288963", "4104251293302371158293528275467990413", "99511412315351717359399337255760802164", "302751797180543245051016195316398885469", "323471583634480048308817122283371712665" ], "threshold": 0.9 }, "signature_type": "Line", "target": { "file": "drivers/net/can/dev/dev.c" }, "id": "CVE-2025-38665-cd761226", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6bbcf37c5114926c99a1d1e6993a5b35689d2599", "signature_version": "v1" }, { "deprecated": false, "digest": { "length": 241.0, "function_hash": "297833769956012656914742280566819677666" }, "signature_type": "Function", "target": { "file": "drivers/net/can/dev/dev.c", "function": "can_restart_now" }, "id": "CVE-2025-38665-d30608a2", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6bbcf37c5114926c99a1d1e6993a5b35689d2599", "signature_version": "v1" }, { "deprecated": false, "digest": { "length": 3868.0, "function_hash": "216194316129519015704995399310011552796" }, "signature_type": "Function", "target": { "file": "drivers/net/can/dev/netlink.c", "function": "can_changelink" }, "id": "CVE-2025-38665-dd08d978", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cf81a60a973358dea163f6b14062f17831ceb894", "signature_version": "v1" }, { "deprecated": false, "digest": { "line_hashes": [ "124872885127474908693974638268981038124", "217939689743117838756805643262440599418", "233968603977748773654489088371244291139", "279620314014585599414782050031018636815", "92828297381857719808518811736670721470", "97193902919396231048726004017930740685", "214212848302327897308073668849784757361", "31050427929594297039615554271014414440", "314241280548713211862807110204329393121", "57575103651222150509814457969913512780", "316896714463549546515471706705496801239", "91497817132972580002012994215421059342", "93650495709941309928587032116205851538", "239366991486651847400442052197302214855", "6589136892238685228284471114207555656", "200958411480217458699564219340712864357", "82866874222804369496422654998811682425", "192723010879275460090840901347798288963", "4104251293302371158293528275467990413", "99511412315351717359399337255760802164", "302751797180543245051016195316398885469", "323471583634480048308817122283371712665" ], "threshold": 0.9 }, "signature_type": "Line", "target": { "file": "drivers/net/can/dev/dev.c" }, "id": "CVE-2025-38665-ec0d0e37", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6acceb46180f9e160d4f0c56fcaf39ba562822ae", "signature_version": "v1" }, { "deprecated": false, "digest": { "line_hashes": [ "212935876875138213374378540937962986671", "201005658758910484060393075955960657357", "170188525157207435629014269226293727313", "146023379445608895367282226963273564098", "127015060221764579149250872859977492053", "8152680011096060708744070511894525884", "25701752523623369805577184256834568280", "57773571300944415166867789941509140144" ], "threshold": 0.9 }, "signature_type": "Line", "target": { "file": "drivers/net/can/dev/netlink.c" }, "id": "CVE-2025-38665-f6840a69", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6acceb46180f9e160d4f0c56fcaf39ba562822ae", "signature_version": "v1" } ]