CVE-2025-39988: can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow
can: etases58x: populate ndochangemtu() to prevent buffer overflow
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.15-1Fixed in 7.3.3-1 - Configuration
Populate net_device_ops->ndo_change_mtu() so the interface MTU cannot be set higher than CAN_MTU or CANFD_MTU, depending on the device capabilities.
Linux kernel etas_es58x CAN driver net_device_ops->ndo_change_mtu() = Limit MTU to CAN_MTU or CANFD_MTU according to device capabilities
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39988?
CVE-2025-39988 has a high severity rating due to the potential for remote code execution via buffer overflow.
How do I fix CVE-2025-39988?
To fix CVE-2025-39988, update your Linux kernel to the latest patched version provided by your distribution.
What systems are affected by CVE-2025-39988?
CVE-2025-39988 affects the Linux kernel and any systems utilizing the vulnerable version.
What types of attacks can CVE-2025-39988 facilitate?
CVE-2025-39988 can facilitate remote attacks that lead to denial of service or arbitrary code execution.
Is CVE-2025-39988 being actively exploited?
At this time, there are no confirmed reports of CVE-2025-39988 being actively exploited in the wild.