The bonding driver in the Linux kernel incorrectly attempts to enslave virtual CAN (vxcan) devices as if they were Ethernet interfaces. During this process the driver mutates internal state structures that are not initialized for CAN traffic, leading to a null‑pointer dereference in can_rx_unregister. The resulting kernel panic is a denial of service. The flaw represents a classic null‑pointer dereference (CWE‑476) that impacts system integrity and availability when a CAN socket is closed after an illegal enslavement.

The vulnerability affects the Linux kernel's bonding driver. Any kernel that has bonding enabled and allows a virtual CAN (vxcan) interface to be enslaved to a bond master is potentially vulnerable. Versions of the kernel predating the patch that introduced the guard against bonding ARPHRD_CAN devices are at risk.

Based on the description, it is inferred that the likely attack vector is local. The CVSS score for this issue is 5.5, indicating moderate severity, and the EPSS score is less than 1 %, implying a low probability of exploitation in so no known large‑scale exploitation has been reported. A local attacker with the ability to create or configure a virtual CAN interface could trigger the flaw by enslaving the device to a bond master; this might be achieved by a privileged user or through misconfigured network scripts. Because the issue requires local manipulation of network interface state and does not involve a remote code execution pathway, the overall risk is moderate, but the impact of a successful trigger—kernel crash resulting in system downtime—is significant.