CVE-2025-38665

In the Linux kernel, the following vulnerability has been resolved:

can: netlink: canchangelink(): fix NULL pointer deref of struct canpriv::dosetmode

Andrei Lalaev reported a NULL pointer deref when a CAN device is restarted from Bus Off and the driver does not implement the struct canpriv::doset_mode callback.

There are 2 code path that call struct canpriv::dosetmode: - directly by a manual restart from the user space, via canchangelink() - delayed automatic restart after bus off (deactivated by default)

To prevent the NULL pointer deference, refuse a manual restart or configure the automatic restart delay in can_changelink() and report the error via extack to user space.

As an additional safety measure let canrestart() return an error if canpriv::dosetmode is not set instead of dereferencing it unchecked.