CVE-2025-37993: can: m_can: m_can_class_allocate_dev(): initialize spin lock on device probe
In the Linux kernel, the following vulnerability has been resolved:
can: mcan: mcanclassallocatedev(): initialize spin lock on device probe
The spin lock txhandlingspinlock in struct mcanclassdev is not being initialized. This leads the following spinlock bad magic complaint from the kernel, eg. when trying to send CAN frames with cansend from can-utils:
| BUG: spinlock bad magic on CPU#0, cansend/95 | lock: 0xff60000002ec1010, .magic: 00000000, .owner: <none>/-1, .ownercpu: 0 | CPU: 0 UID: 0 PID: 95 Comm: cansend Not tainted 6.15.0-rc3-00032-ga79be02bba5c #5 NONE | Hardware name: MachineWare SIM-V (DT) | Call Trace: | [<ffffffff800133e0>] dumpbacktrace+0x1c/0x24 | [<ffffffff800022f2>] showstack+0x28/0x34 | [<ffffffff8000de3e>] dumpstacklvl+0x4a/0x68 | [<ffffffff8000de70>] dumpstack+0x14/0x1c | [<ffffffff80003134>] spindump+0x62/0x6e | [<ffffffff800883ba>] dorawspinlock+0xd0/0x142 | [<ffffffff807a6fcc>] rawspinlockirqsave+0x20/0x2c | [<ffffffff80536dba>] mcanstartxmit+0x90/0x34a | [<ffffffff806148b0>] devhardstartxmit+0xa6/0xee | [<ffffffff8065b730>] schdirectxmit+0x114/0x292 | [<ffffffff80614e2a>] devqueuexmit+0x3b0/0xaa8 | [<ffffffff8073b8fa>] cansend+0xc6/0x242 | [<ffffffff8073d1c0>] rawsendmsg+0x1a8/0x36c | [<ffffffff805ebf06>] sockwriteiter+0x9a/0xee | [<ffffffff801d06ea>] vfswrite+0x184/0x3a6 | [<ffffffff801d0a88>] ksyswrite+0xa0/0xc0 | [<ffffffff801d0abc>] riscvsyswrite+0x14/0x1c | [<ffffffff8079ebf8>] dotrapecallu+0x168/0x212 | [<ffffffff807a830a>] handleexception+0x146/0x152
Initializing the spin lock in mcanclassallocatedev solves that problem.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-37993?
CVE-2025-37993 is classified with a low to medium severity due to the improper initialization of a spin lock in the Linux kernel.
How do I fix CVE-2025-37993?
To fix CVE-2025-37993, update your Linux kernel to the latest patched version that resolves this vulnerability.
What impact does CVE-2025-37993 have on the Linux kernel?
CVE-2025-37993 can potentially lead to a spinlock initialization issue that may cause instability or unexpected behavior during device probe.
When was CVE-2025-37993 reported?
CVE-2025-37993 was reported and subsequently addressed in updates to the Linux kernel.
Which versions of the Linux kernel are affected by CVE-2025-37993?
CVE-2025-37993 affects specific versions of the Linux kernel that do not include the security fixes for the spin lock issue.