CVE-2025-38665: can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode
can: netlink: canchangelink(): fix NULL pointer deref of struct canpriv::dosetmode
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.104.2-1 - Configuration
Update the Linux kernel CAN netlink code so that automatic restart delay after Bus Off is configured in can_changelink(), and that any failure (e.g., manual restart being refused because can_priv::do_set_mode is not set) is reported to user space via extack.
Linux kernel CAN netlink (can_changelink) automatic restart delay after Bus Off = configure the delay in can_changelink() and report errors via extack to user space - Configuration
Modify can_changelink() to refuse a manual restart when struct can_priv::do_set_mode is not set, instead of dereferencing it, preventing the NULL pointer dereference.
Linux kernel CAN netlink (can_changelink) manual restart handling when can_priv::do_set_mode is NULL = refuse manual restart if can_priv::do_set_mode is not set
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38665?
CVE-2025-38665 has been classified as a high severity vulnerability due to the potential for a NULL pointer dereference.
How do I fix CVE-2025-38665?
To fix CVE-2025-38665, ensure your Linux kernel is updated to the latest version where this vulnerability has been patched.
Which systems are affected by CVE-2025-38665?
CVE-2025-38665 affects systems running versions of the Linux kernel that handle CAN devices.
What type of vulnerability is CVE-2025-38665?
CVE-2025-38665 is a NULL pointer dereference vulnerability affecting the CAN protocol implementation in the Linux kernel.
When was CVE-2025-38665 reported?
CVE-2025-38665 was reported by researcher Andrei Lalaev.