CVE-2025-40107: can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled

Affected Software

Remediation

Recommended actions to resolve this vulnerability, in priority order.

1. Upgrade

   Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.

   Fixed in 6.8.0-1050.53~22.04.1
2. Upgrade

   Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.

   Fixed in 6.8.0-1051.57~22.04.1
3. Upgrade

   Upgrade ubuntu/linux-azure-fde-6.8 to a version that resolves this vulnerability.

   Fixed in 6.8.0-1058.65~22.04.1
4. Upgrade

   Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.

   Fixed in 6.8.0-1052.55~22.04.1
5. Upgrade

   Upgrade ubuntu/linux-hwe-6.8 to a version that resolves this vulnerability.

   Fixed in 6.8.0-106.106~22.04.1
6. Upgrade

   Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.

   Fixed in 6.8.0-1049.49~22.04.1
7. Upgrade

   Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.

   Fixed in 6.8.0-106.106.1~22.04.1
8. Upgrade

   Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.

   Fixed in 6.8.0-1049.52~22.04.1
9. Upgrade

   Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.

   Fixed in 6.8.0-1047.48~22.04.1
10. Upgrade

    Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-106.106~22.04.1
11. Upgrade

    Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.1-1045.46~22.04.1
12. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 6.8.0-106.106
13. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 6.8.0-1050.53
14. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 6.8.0-1051.57
15. Upgrade

    Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.

    Fixed in 6.8.0-1058.65
16. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 6.8.0-1052.55
17. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 6.8.0-1048.53
18. Upgrade

    Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.

    Fixed in 6.8.0-1035.38
19. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 6.8.0-1049.49
20. Upgrade

    Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.

    Fixed in 6.8.0-106.106.1
21. Upgrade

    Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.

    Fixed in 6.8.0-1049.52
22. Upgrade

    Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.

    Fixed in 6.8.0-1049.52.1
23. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.

    Fixed in 6.8.0-1020.20
24. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 6.8.0-1047.48
25. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 6.8.0-1050.54
26. Upgrade

    Upgrade ubuntu/linux-xilinx to a version that resolves this vulnerability.

    Fixed in 6.8.0-1028.29
27. Upgrade

    Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.

    Fixed in 6.8.0-1017.21
28. Upgrade

    Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.

    Fixed in 6.8.0-2040.41
29. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 6.8.1-1045.46
30. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-1050.53+fips1
31. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-1052.58+fips1
32. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-106.106+fips1
33. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-1052.55+fips1
34. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 6.17.0-6.6
35. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 6.17.0-1003.3
36. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 6.17.0-1006.6
37. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 6.17.0-1003.3
38. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 6.17.0-1003.3
39. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 6.17.0-1004.4
40. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 6.17.0-1002.3
41. Upgrade

    Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.

    Fixed in 6.17.0-6.6.1
42. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.15-1Fixed in 7.3.3-1
43. Compensating control

    Move allocation and initialization of the hi311x driver's priv->wq workqueue from hi3110_open to hi3110_can_probe so it is initialized before device resume schedules priv->restart_work.

Event History

Parent advisories

This vulnerability appears in the following advisories.

• DSA-6053

Peer vulnerabilities

Found alongside the following vulnerabilities.

• DLA-4379-1

Frequently Asked Questions