In the Linux kernel, the following vulnerability has been resolved:
can: netlink: canchangelink(): fix NULL pointer deref of struct canpriv::dosetmode
Andrei Lalaev reported a NULL pointer deref when a CAN device is restarted from Bus Off and the driver does not implement the struct canpriv::doset_mode callback.
There are 2 code path that call struct canpriv::dosetmode: - directly by a manual restart from the user space, via canchangelink() - delayed automatic restart after bus off (deactivated by default)
To prevent the NULL pointer deference, refuse a manual restart or configure the automatic restart delay in can_changelink() and report the error via extack to user space.
As an additional safety measure let canrestart() return an error if canpriv::dosetmode is not set instead of dereferencing it unchecked.
[
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c1f3f9797c1f44a762e6f5f72520b2e520537b52",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"124872885127474908693974638268981038124",
"217939689743117838756805643262440599418",
"233968603977748773654489088371244291139",
"279620314014585599414782050031018636815",
"92828297381857719808518811736670721470",
"97193902919396231048726004017930740685",
"214212848302327897308073668849784757361",
"31050427929594297039615554271014414440",
"314241280548713211862807110204329393121",
"57575103651222150509814457969913512780",
"316896714463549546515471706705496801239",
"91497817132972580002012994215421059342",
"93650495709941309928587032116205851538",
"239366991486651847400442052197302214855",
"6589136892238685228284471114207555656",
"200958411480217458699564219340712864357",
"82866874222804369496422654998811682425",
"192723010879275460090840901347798288963",
"4104251293302371158293528275467990413",
"99511412315351717359399337255760802164",
"302751797180543245051016195316398885469",
"323471583634480048308817122283371712665"
]
},
"deprecated": false,
"target": {
"file": "drivers/net/can/dev/dev.c"
},
"id": "CVE-2025-38665-08a94175"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c1f3f9797c1f44a762e6f5f72520b2e520537b52",
"signature_type": "Function",
"digest": {
"length": 3953.0,
"function_hash": "249180819659891154353799249653974136923"
},
"deprecated": false,
"target": {
"function": "can_changelink",
"file": "drivers/net/can/dev/netlink.c"
},
"id": "CVE-2025-38665-25bce04c"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6acceb46180f9e160d4f0c56fcaf39ba562822ae",
"signature_type": "Function",
"digest": {
"length": 3868.0,
"function_hash": "216194316129519015704995399310011552796"
},
"deprecated": false,
"target": {
"function": "can_changelink",
"file": "drivers/net/can/dev/netlink.c"
},
"id": "CVE-2025-38665-30ed91b2"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c1f3f9797c1f44a762e6f5f72520b2e520537b52",
"signature_type": "Function",
"digest": {
"length": 241.0,
"function_hash": "297833769956012656914742280566819677666"
},
"deprecated": false,
"target": {
"function": "can_restart_now",
"file": "drivers/net/can/dev/dev.c"
},
"id": "CVE-2025-38665-4312688a"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c1f3f9797c1f44a762e6f5f72520b2e520537b52",
"signature_type": "Function",
"digest": {
"length": 620.0,
"function_hash": "40968664299607619706412846533154184946"
},
"deprecated": false,
"target": {
"function": "can_restart",
"file": "drivers/net/can/dev/dev.c"
},
"id": "CVE-2025-38665-6e540a0a"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6acceb46180f9e160d4f0c56fcaf39ba562822ae",
"signature_type": "Function",
"digest": {
"length": 620.0,
"function_hash": "40968664299607619706412846533154184946"
},
"deprecated": false,
"target": {
"function": "can_restart",
"file": "drivers/net/can/dev/dev.c"
},
"id": "CVE-2025-38665-70e3ffdc"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6bbcf37c5114926c99a1d1e6993a5b35689d2599",
"signature_type": "Function",
"digest": {
"length": 3810.0,
"function_hash": "181991567613757313545603702389467792917"
},
"deprecated": false,
"target": {
"function": "can_changelink",
"file": "drivers/net/can/dev/netlink.c"
},
"id": "CVE-2025-38665-7b5f798f"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6bbcf37c5114926c99a1d1e6993a5b35689d2599",
"signature_type": "Function",
"digest": {
"length": 620.0,
"function_hash": "40968664299607619706412846533154184946"
},
"deprecated": false,
"target": {
"function": "can_restart",
"file": "drivers/net/can/dev/dev.c"
},
"id": "CVE-2025-38665-84229cb6"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c1f3f9797c1f44a762e6f5f72520b2e520537b52",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"212935876875138213374378540937962986671",
"201005658758910484060393075955960657357",
"170188525157207435629014269226293727313",
"146023379445608895367282226963273564098",
"127015060221764579149250872859977492053",
"8152680011096060708744070511894525884",
"25701752523623369805577184256834568280",
"57773571300944415166867789941509140144"
]
},
"deprecated": false,
"target": {
"file": "drivers/net/can/dev/netlink.c"
},
"id": "CVE-2025-38665-a5168276"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6acceb46180f9e160d4f0c56fcaf39ba562822ae",
"signature_type": "Function",
"digest": {
"length": 241.0,
"function_hash": "297833769956012656914742280566819677666"
},
"deprecated": false,
"target": {
"function": "can_restart_now",
"file": "drivers/net/can/dev/dev.c"
},
"id": "CVE-2025-38665-b2d8705f"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6bbcf37c5114926c99a1d1e6993a5b35689d2599",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"132364512970370532113861230153256308021",
"120301805644430222381928502750559789808",
"170188525157207435629014269226293727313",
"146023379445608895367282226963273564098",
"127015060221764579149250872859977492053",
"8152680011096060708744070511894525884",
"25701752523623369805577184256834568280",
"57773571300944415166867789941509140144"
]
},
"deprecated": false,
"target": {
"file": "drivers/net/can/dev/netlink.c"
},
"id": "CVE-2025-38665-b2fb0597"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6bbcf37c5114926c99a1d1e6993a5b35689d2599",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"124872885127474908693974638268981038124",
"217939689743117838756805643262440599418",
"233968603977748773654489088371244291139",
"279620314014585599414782050031018636815",
"92828297381857719808518811736670721470",
"97193902919396231048726004017930740685",
"214212848302327897308073668849784757361",
"31050427929594297039615554271014414440",
"314241280548713211862807110204329393121",
"57575103651222150509814457969913512780",
"316896714463549546515471706705496801239",
"91497817132972580002012994215421059342",
"93650495709941309928587032116205851538",
"239366991486651847400442052197302214855",
"6589136892238685228284471114207555656",
"200958411480217458699564219340712864357",
"82866874222804369496422654998811682425",
"192723010879275460090840901347798288963",
"4104251293302371158293528275467990413",
"99511412315351717359399337255760802164",
"302751797180543245051016195316398885469",
"323471583634480048308817122283371712665"
]
},
"deprecated": false,
"target": {
"file": "drivers/net/can/dev/dev.c"
},
"id": "CVE-2025-38665-cd761226"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6bbcf37c5114926c99a1d1e6993a5b35689d2599",
"signature_type": "Function",
"digest": {
"length": 241.0,
"function_hash": "297833769956012656914742280566819677666"
},
"deprecated": false,
"target": {
"function": "can_restart_now",
"file": "drivers/net/can/dev/dev.c"
},
"id": "CVE-2025-38665-d30608a2"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6acceb46180f9e160d4f0c56fcaf39ba562822ae",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"124872885127474908693974638268981038124",
"217939689743117838756805643262440599418",
"233968603977748773654489088371244291139",
"279620314014585599414782050031018636815",
"92828297381857719808518811736670721470",
"97193902919396231048726004017930740685",
"214212848302327897308073668849784757361",
"31050427929594297039615554271014414440",
"314241280548713211862807110204329393121",
"57575103651222150509814457969913512780",
"316896714463549546515471706705496801239",
"91497817132972580002012994215421059342",
"93650495709941309928587032116205851538",
"239366991486651847400442052197302214855",
"6589136892238685228284471114207555656",
"200958411480217458699564219340712864357",
"82866874222804369496422654998811682425",
"192723010879275460090840901347798288963",
"4104251293302371158293528275467990413",
"99511412315351717359399337255760802164",
"302751797180543245051016195316398885469",
"323471583634480048308817122283371712665"
]
},
"deprecated": false,
"target": {
"file": "drivers/net/can/dev/dev.c"
},
"id": "CVE-2025-38665-ec0d0e37"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6acceb46180f9e160d4f0c56fcaf39ba562822ae",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"212935876875138213374378540937962986671",
"201005658758910484060393075955960657357",
"170188525157207435629014269226293727313",
"146023379445608895367282226963273564098",
"127015060221764579149250872859977492053",
"8152680011096060708744070511894525884",
"25701752523623369805577184256834568280",
"57773571300944415166867789941509140144"
]
},
"deprecated": false,
"target": {
"file": "drivers/net/can/dev/netlink.c"
},
"id": "CVE-2025-38665-f6840a69"
}
]