A flaw in the Linux kernel’s CAN stack removes essential header initialization from newly allocated socket buffers. When these buffers reach the packet receive path, the resulting malformed header causes a length overflow, triggering an internal kernel panic that brings the entire machine down. The impact is a denial of service that could be leveraged by an attacker to crash a host, and in environments where the kernel restarts automatically, could enable further exploitation attempts.

All Linux kernel builds that include the change which removed skb_reset_mac_header(), skb_reset_network_header(), and skb_reset_transport_header() from init_can_skb() – effectively any current kernel generation that incorporates commit 9f10374bb024. The original bug was fixed in 2014 by adding the missing initialisations (commit 969439016d2c) and later hardened packet receive checks (commit d549699048b4). Users of kernel versions that have not applied these upstream fixes are at risk.

The CVSS score is not provided and EPSS is not available, but the bug can be triggered by external CAN traffic, making it a likely remote denial of service vector. The vulnerability is not in the CISA KEV catalog, but the lack of hardening means attackers do not need elevated privileges to deliver malicious packets. Once the overflow occurs, a kernel panic ensues, forcing a reboot that can be repeated to destabilise critical infrastructure. Given the severity of a full system crash and the ability to exploit remotely, the risk is high and mitigation should be prioritized.