CVE-2025-38665 Details
Description
In the Linux kernel, the following vulnerability has been resolved: can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode Andrei Lalaev reported a NULL pointer deref when a CAN device is restarted from Bus Off and the driver does not implement the struct can_priv::do_set_mode callback. There are 2 code path that call struct can_priv::do_set_mode: - directly by a manual restart from the user space, via can_changelink() - delayed automatic restart after bus off (deactivated by default) To prevent the NULL pointer deference, refuse a manual restart or configure the automatic restart delay in can_changelink() and report the error via extack to user space. As an additional safety measure let can_restart() return an error if can_priv::do_set_mode is not set instead of dereferencing it unchecked.
A NULL pointer dereference vulnerability has been identified in the Linux kernel's CAN netlink implementation. This issue occurs when a CAN device is manually restarted from a 'Bus Off' state, and the corresponding driver does not provide a specific callback function. The vulnerability can be triggered through direct user-space commands or by automatic restarts after a 'Bus Off' event, which is typically disabled by default. The absence of the required callback leads to an unhandled NULL pointer dereference, potentially causing a system crash.
The vulnerability has been addressed in Linux kernel commits '0ca816a96fdcf32644c80cbe7a82c7b6ce6ddda5', '6acceb46180f9e160d4f0c56fcaf39ba562822ae', '6bbcf37c5114926c99a1d1e6993a5b35689d2599', and 'cf81a60a973358dea163f6b14062f17831ceb894'. Users should upgrade to the latest version of the Linux kernel stable tree.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/0ca816a96fdcf32644c80cbe7a82c7b6ce6ddda5 | kernel.org | Patch |
| https://git.kernel.org/stable/c/6acceb46180f9e160d4f0c56fcaf39ba562822ae | kernel.org | Patch |
| https://git.kernel.org/stable/c/6bbcf37c5114926c99a1d1e6993a5b35689d2599 | kernel.org | Patch |
| https://git.kernel.org/stable/c/c1f3f9797c1f44a762e6f5f72520b2e520537b52 | kernel.org | Patch |
| https://git.kernel.org/stable/c/cf81a60a973358dea163f6b14062f17831ceb894 | kernel.org | Patch |
| https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html | CVE | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 2.6.31, < 6.1.148 >= 6.2, < 6.6.101 >= 6.7, < 6.12.41 >= 6.13, < 6.15.9 6.16 rc1 6.16 rc2 6.16 rc3 6.16 rc4 6.16 rc5 6.16 rc6 6.16 rc7 |
CPE
Remediation
| |
| debian debian linux | 11.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jan 7, 2026 | Initial Analysis | [email protected] |
| Nov 3, 2025 | CVE Modified | CVE |
| Aug 22, 2025 | New CVE Received | kernel.org |