CVE-2025-39986

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-39986", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.150Z", "datePublished": "2025-10-15T07:56:05.143Z", "dateUpdated": "2026-08-05T12:06:53.662Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:06:53.662Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow\n\nSending an PF_PACKET allows to bypass the CAN framework logic and to\ndirectly reach the xmit() function of a CAN driver. The only check\nwhich is performed by the PF_PACKET framework is to make sure that\nskb->len fits the interface's MTU.\n\nUnfortunately, because the sun4i_can driver does not populate its\nnet_device_ops->ndo_change_mtu(), it is possible for an attacker to\nconfigure an invalid MTU by doing, for example:\n\n $ ip link set can0 mtu 9999\n\nAfter doing so, the attacker could open a PF_PACKET socket using the\nETH_P_CANXL protocol:\n\n\tsocket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL))\n\nto inject a malicious CAN XL frames. For example:\n\n\tstruct canxl_frame frame = {\n\t\t.flags = 0xff,\n\t\t.len = 2048,\n\t};\n\nThe CAN drivers' xmit() function are calling can_dev_dropped_skb() to\ncheck that the skb is valid, unfortunately under above conditions, the\nmalicious packet is able to go through can_dev_dropped_skb() checks:\n\n 1. the skb->protocol is set to ETH_P_CANXL which is valid (the\n function does not check the actual device capabilities).\n\n 2. the length is a valid CAN XL length.\n\nAnd so, sun4ican_start_xmit() receives a CAN XL frame which it is not\nable to correctly handle and will thus misinterpret it as a CAN frame.\n\nThis can result in a buffer overflow. The driver will consume cf->len\nas-is with no further checks on this line:\n\n\tdlc = cf->len;\n\nHere, cf->len corresponds to the flags field of the CAN XL frame. In\nour previous example, we set canxl_frame->flags to 0xff. Because the\nmaximum expected length is 8, a buffer overflow of 247 bytes occurs a\ncouple line below when doing:\n\n\tfor (i = 0; i < dlc; i++)\n\t\twritel(cf->data[i], priv->base + (dreg + i * 4));\n\nPopulate net_device_ops->ndo_change_mtu() to ensure that the\ninterface's MTU can not be set to anything bigger than CAN_MTU. By\nfixing the root cause, this prevents the buffer overflow."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Triggering requires local syscalls on the host \u2014 `socket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL))` followed by `sendmsg()` to the can interface, reaching `sun4ican_start_xmit()` through `dev_queue_xmit()`. The bug is entirely in the TX path; a remote or adjacent CAN-bus peer is only the sink and cannot reach it.\nAC:L - The overflow is fully deterministic \u2014 `can_dropped_invalid_skb()` accepts an ETH_P_CANXL skb on a classic-CAN device, `canxl_frame.flags` is reinterpreted as `can_frame.len`, and the loop unconditionally walks up to 255 elements. No race, no memory-layout guessing, and no condition outside the attacker's control is involved.\nPR:L - The only gate is `ns_capable(net->user_ns, CAP_NET_RAW)` in `packet_create()`, which is namespaced and granted by default in common container runtimes; because a 13\u201316 byte CAN XL frame already passes the default CAN_MTU check, the CAP_NET_ADMIN MTU change is not even needed. CAN netdevs are not netns-local, so a `can0` delegated into a container/user namespace lets an otherwise unprivileged user trigger this with no real root.\nUI:N - The attacker performs every step alone \u2014 open the packet socket and send one malicious CAN XL frame to an up CAN interface. No victim action, no configuration change by an administrator, and no interaction of any kind is required.\nS:U - The out-of-bounds read and the runaway MMIO writes stay within the kernel of the same host; no VM, hypervisor, or IOMMU boundary is crossed. The vulnerable component and the impacted resources share a single security authority.\nC:H - With a minimal 13\u201316 byte skb the loop reads `cf->data[0..254]`, over-reading roughly 247 bytes of adjacent kernel heap past the packet data. That residue is pushed into the controller's registers and, with self-reception/loopback enabled, bytes beyond `skb->len` are echoed back to userspace, giving a repeatable kernel-memory disclosure primitive.\nI:H - Up to 254 attacker-influenced 32-bit stores land beyond the intended 8-byte TX buffer slot, overwriting the entire sun4i CAN register block (acceptance/readback/reserved registers) with out-of-bounds heap contents. This is a controlled out-of-bounds write that corrupts device state and, past `0x400`, writes to memory outside the ioremap mapping entirely.\nA:H - For `dlc` above 235 the write offset exceeds the `0x400` ioremap window, and since the mapping ends exactly on a page boundary the next page is the vmalloc guard page \u2014 an unmapped kernel VA store that produces an immediate oops/panic. The condition is re-triggerable at will from an unprivileged socket, and the register scribbling wedges the CAN controller even when the fault is avoided."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/can/sun4i_can.c"], "versions": [{"version": "0738eff14d817a02ab082c392c96a1613006f158", "lessThan": "063539db42203b29d5aa2adf0cae3d68c646a6b6", "status": "affected", "versionType": "git"}, {"version": "0738eff14d817a02ab082c392c96a1613006f158", "lessThan": "4f382cc887adca8478b9d3e6b81aa6698a95fff4", "status": "affected", "versionType": "git"}, {"version": "0738eff14d817a02ab082c392c96a1613006f158", "lessThan": "60463a1c138900494cb3adae41142a11cd8feb3c", "status": "affected", "versionType": "git"}, {"version": "0738eff14d817a02ab082c392c96a1613006f158", "lessThan": "a61ff7ac93270d20ca426c027d6d01c8ac8e904c", "status": "affected", "versionType": "git"}, {"version": "0738eff14d817a02ab082c392c96a1613006f158", "lessThan": "2e423e1990f3972cbea779883fef52c2f2acb858", "status": "affected", "versionType": "git"}, {"version": "0738eff14d817a02ab082c392c96a1613006f158", "lessThan": "de77841652e57afbc46e9e1dbf51ee364fc008e1", "status": "affected", "versionType": "git"}, {"version": "0738eff14d817a02ab082c392c96a1613006f158", "lessThan": "7f7b21026a6febdb749f6f6f950427245aa86cce", "status": "affected", "versionType": "git"}, {"version": "0738eff14d817a02ab082c392c96a1613006f158", "lessThan": "61da0bd4102c459823fbe6b8b43b01fb6ace4a22", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/can/sun4i_can.c"], "versions": [{"version": "4.4", "status": "affected"}, {"version": "0", "lessThan": "4.4", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.300", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.245", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.194", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.155", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.109", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.50", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16.10", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "5.4.300"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "5.10.245"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "5.15.194"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.1.155"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.6.109"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.12.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.16.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.17"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/063539db42203b29d5aa2adf0cae3d68c646a6b6"}, {"url": "https://git.kernel.org/stable/c/4f382cc887adca8478b9d3e6b81aa6698a95fff4"}, {"url": "https://git.kernel.org/stable/c/60463a1c138900494cb3adae41142a11cd8feb3c"}, {"url": "https://git.kernel.org/stable/c/a61ff7ac93270d20ca426c027d6d01c8ac8e904c"}, {"url": "https://git.kernel.org/stable/c/2e423e1990f3972cbea779883fef52c2f2acb858"}, {"url": "https://git.kernel.org/stable/c/de77841652e57afbc46e9e1dbf51ee364fc008e1"}, {"url": "https://git.kernel.org/stable/c/7f7b21026a6febdb749f6f6f950427245aa86cce"}, {"url": "https://git.kernel.org/stable/c/61da0bd4102c459823fbe6b8b43b01fb6ace4a22"}], "title": "can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/can/sun4i_can.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "063539db42203b29d5aa2adf0cae3d68c646a6b6", "status": "affected", "version": "0738eff14d817a02ab082c392c96a1613006f158", "versionType": "git"}, {"lessThan": "4f382cc887adca8478b9d3e6b81aa6698a95fff4", "status": "affected", "version": "0738eff14d817a02ab082c392c96a1613006f158", "versionType": "git"}, {"lessThan": "60463a1c138900494cb3adae41142a11cd8feb3c", "status": "affected", "version": "0738eff14d817a02ab082c392c96a1613006f158", "versionType": "git"}, {"lessThan": "a61ff7ac93270d20ca426c027d6d01c8ac8e904c", "status": "affected", "version": "0738eff14d817a02ab082c392c96a1613006f158", "versionType": "git"}, {"lessThan": "2e423e1990f3972cbea779883fef52c2f2acb858", "status": "affected", "version": "0738eff14d817a02ab082c392c96a1613006f158", "versionType": "git"}, {"lessThan": "de77841652e57afbc46e9e1dbf51ee364fc008e1", "status": "affected", "version": "0738eff14d817a02ab082c392c96a1613006f158", "versionType": "git"}, {"lessThan": "7f7b21026a6febdb749f6f6f950427245aa86cce", "status": "affected", "version": "0738eff14d817a02ab082c392c96a1613006f158", "versionType": "git"}, {"lessThan": "61da0bd4102c459823fbe6b8b43b01fb6ace4a22", "status": "affected", "version": "0738eff14d817a02ab082c392c96a1613006f158", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/can/sun4i_can.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.4"}, {"lessThan": "4.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.300", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.245", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.194", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.155", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.109", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.50", "versionType": "semver"}, {"lessThanOrEqual": "6.16.*", "status": "unaffected", "version": "6.16.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow\n\nSending an PF_PACKET allows to bypass the CAN framework logic and to\ndirectly reach the xmit() function of a CAN driver. The only check\nwhich is performed by the PF_PACKET framework is to make sure that\nskb->len fits the interface's MTU.\n\nUnfortunately, because the sun4i_can driver does not populate its\nnet_device_ops->ndo_change_mtu(), it is possible for an attacker to\nconfigure an invalid MTU by doing, for example:\n\n $ ip link set can0 mtu 9999\n\nAfter doing so, the attacker could open a PF_PACKET socket using the\nETH_P_CANXL protocol:\n\n\tsocket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL))\n\nto inject a malicious CAN XL frames. For example:\n\n\tstruct canxl_frame frame = {\n\t\t.flags = 0xff,\n\t\t.len = 2048,\n\t};\n\nThe CAN drivers' xmit() function are calling can_dev_dropped_skb() to\ncheck that the skb is valid, unfortunately under above conditions, the\nmalicious packet is able to go through can_dev_dropped_skb() checks:\n\n 1. the skb->protocol is set to ETH_P_CANXL which is valid (the\n function does not check the actual device capabilities).\n\n 2. the length is a valid CAN XL length.\n\nAnd so, sun4ican_start_xmit() receives a CAN XL frame which it is not\nable to correctly handle and will thus misinterpret it as a CAN frame.\n\nThis can result in a buffer overflow. The driver will consume cf->len\nas-is with no further checks on this line:\n\n\tdlc = cf->len;\n\nHere, cf->len corresponds to the flags field of the CAN XL frame. In\nour previous example, we set canxl_frame->flags to 0xff. Because the\nmaximum expected length is 8, a buffer overflow of 247 bytes occurs a\ncouple line below when doing:\n\n\tfor (i = 0; i < dlc; i++)\n\t\twritel(cf->data[i], priv->base + (dreg + i * 4));\n\nPopulate net_device_ops->ndo_change_mtu() to ensure that the\ninterface's MTU can not be set to anything bigger than CAN_MTU. By\nfixing the root cause, this prevents the buffer overflow."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncan: sun4i_can: poblar ndo_change_mtu() para prevenir desbordamiento de b\u00fafer\n\nEnviar un PF_PACKET permite eludir la l\u00f3gica del framework CAN y alcanzar directamente la funci\u00f3n xmit() de un controlador CAN. La \u00fanica verificaci\u00f3n que realiza el framework PF_PACKET es asegurarse de que skb->len se ajuste a la MTU de la interfaz.\n\nDesafortunadamente, debido a que el controlador sun4i_can no puebla su net_device_ops->ndo_change_mtu(), es posible para un atacante configurar una MTU inv\u00e1lida haciendo, por ejemplo:\n\n $ ip link set can0 mtu 9999\n\nDespu\u00e9s de hacer esto, el atacante podr\u00eda abrir un socket PF_PACKET usando el protocolo ETH_P_CANXL:\n\n\tsocket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL))\n\npara inyectar tramas CAN XL maliciosas. Por ejemplo:\n\n\tstruct canxl_frame frame = {\n\t\t.flags = 0xff,\n\t\t.len = 2048,\n\t};\n\nLa funci\u00f3n xmit() de los controladores CAN est\u00e1 llamando a can_dev_dropped_skb() para verificar que el skb es v\u00e1lido, desafortunadamente bajo las condiciones anteriores, el paquete malicioso es capaz de pasar las verificaciones de can_dev_dropped_skb():\n\n 1. el skb->protocol est\u00e1 configurado a ETH_P_CANXL lo cual es v\u00e1lido (la funci\u00f3n no verifica las capacidades reales del dispositivo).\n\n 2. la longitud es una longitud CAN XL v\u00e1lida.\n\nY as\u00ed, sun4ican_start_xmit() recibe una trama CAN XL que no es capaz de manejar correctamente y, por lo tanto, la malinterpretar\u00e1 como una trama CAN.\n\nEsto puede resultar en un desbordamiento de b\u00fafer. El controlador consumir\u00e1 cf->len tal cual sin m\u00e1s verificaciones en esta l\u00ednea:\n\n\tdlc = cf->len;\n\nAqu\u00ed, cf->len corresponde al campo flags de la trama CAN XL. En nuestro ejemplo anterior, configuramos canxl_frame->flags a 0xff. Debido a que la longitud m\u00e1xima esperada es 8, un desbordamiento de b\u00fafer de 247 bytes ocurre un par de l\u00edneas m\u00e1s abajo al hacer:\n\n\tfor (i = 0; i < dlc; i++)\n\t\twritel(cf->data[i], priv->base + (dreg + i * 4));\n\nPoblar net_device_ops->ndo_change_mtu() para asegurar que la MTU de la interfaz no pueda configurarse a nada mayor que CAN_MTU. Al corregir la causa ra\u00edz, esto previene el desbordamiento de b\u00fafer."}], "id": "CVE-2025-39986", "lastModified": "2026-10-19T21:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2025-10-15T08:15:36.653", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/063539db42203b29d5aa2adf0cae3d68c646a6b6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2e423e1990f3972cbea779883fef52c2f2acb858"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4f382cc887adca8478b9d3e6b81aa6698a95fff4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/60463a1c138900494cb3adae41142a11cd8feb3c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/61da0bd4102c459823fbe6b8b43b01fb6ace4a22"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7f7b21026a6febdb749f6f6f950427245aa86cce"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a61ff7ac93270d20ca426c027d6d01c8ac8e904c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/de77841652e57afbc46e9e1dbf51ee364fc008e1"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow", "id": "2404102", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2404102"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\ncan: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow\nSending an PF_PACKET allows to bypass the CAN framework logic and to\ndirectly reach the xmit() function of a CAN driver. The only check\nwhich is performed by the PF_PACKET framework is to make sure that\nskb->len fits the interface's MTU.\nUnfortunately, because the sun4i_can driver does not populate its\nnet_device_ops->ndo_change_mtu(), it is possible for an attacker to\nconfigure an invalid MTU by doing, for example:\n$ ip link set can0 mtu 9999\nAfter doing so, the attacker could open a PF_PACKET socket using the\nETH_P_CANXL protocol:\nsocket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL))\nto inject a malicious CAN XL frames. For example:\nstruct canxl_frame frame = {\n.flags = 0xff,\n.len = 2048,\n};\nThe CAN drivers' xmit() function are calling can_dev_dropped_skb() to\ncheck that the skb is valid, unfortunately under above conditions, the\nmalicious packet is able to go through can_dev_dropped_skb() checks:\n1. the skb->protocol is set to ETH_P_CANXL which is valid (the\nfunction does not check the actual device capabilities).\n2. the length is a valid CAN XL length.\nAnd so, sun4ican_start_xmit() receives a CAN XL frame which it is not\nable to correctly handle and will thus misinterpret it as a CAN frame.\nThis can result in a buffer overflow. The driver will consume cf->len\nas-is with no further checks on this line:\ndlc = cf->len;\nHere, cf->len corresponds to the flags field of the CAN XL frame. In\nour previous example, we set canxl_frame->flags to 0xff. Because the\nmaximum expected length is 8, a buffer overflow of 247 bytes occurs a\ncouple line below when doing:\nfor (i = 0; i < dlc; i++)\nwritel(cf->data[i], priv->base + (dreg + i * 4));\nPopulate net_device_ops->ndo_change_mtu() to ensure that the\ninterface's MTU can not be set to anything bigger than CAN_MTU. By\nfixing the root cause, this prevents the buffer overflow."], "name": "CVE-2025-39986", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-10-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-39986\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-39986\nhttps://lore.kernel.org/linux-cve-announce/2025101501-CVE-2025-39986-b33b@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-10-20T13:27:11.214944+00:00", "updated": "2025-10-20T13:27:11.214968+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}