In the Linux kernel, the following vulnerability has been resolved: can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode Andrei Lalaev reported a NULL pointer deref when a CAN device is restarted from Bus Off and the driver does not implement the struct can_priv::do_set_mode callback. There are 2 code path that call struct can_priv::do_set_mode: - directly by a manual restart from the user space, via can_changelink() - delayed automatic restart after bus off (deactivated by default) To prevent the NULL pointer deference, refuse a manual restart or configure the automatic restart delay in can_changelink() and report the error via extack to user space. As an additional safety measure let can_restart() return an error if can_priv::do_set_mode is not set instead of dereferencing it unchecked.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/0ca816a96fdcf32644c80cbe7a82c7b6ce6ddda5 cve-icon cve-icon
https://git.kernel.org/stable/c/6acceb46180f9e160d4f0c56fcaf39ba562822ae cve-icon cve-icon
https://git.kernel.org/stable/c/6bbcf37c5114926c99a1d1e6993a5b35689d2599 cve-icon cve-icon
https://git.kernel.org/stable/c/c1f3f9797c1f44a762e6f5f72520b2e520537b52 cve-icon cve-icon
https://git.kernel.org/stable/c/cf81a60a973358dea163f6b14062f17831ceb894 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025082259-CVE-2025-38665-29e2@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-38665 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-38665 cve-icon
History

Sat, 23 Aug 2025 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Vendors & Products Linux
Linux linux Kernel

Sat, 23 Aug 2025 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-476
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Moderate

Fri, 22 Aug 2025 16:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode Andrei Lalaev reported a NULL pointer deref when a CAN device is restarted from Bus Off and the driver does not implement the struct can_priv::do_set_mode callback. There are 2 code path that call struct can_priv::do_set_mode: - directly by a manual restart from the user space, via can_changelink() - delayed automatic restart after bus off (deactivated by default) To prevent the NULL pointer deference, refuse a manual restart or configure the automatic restart delay in can_changelink() and report the error via extack to user space. As an additional safety measure let can_restart() return an error if can_priv::do_set_mode is not set instead of dereferencing it unchecked.
Title can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2025-08-22T16:02:57.458Z

Updated: 2025-08-22T16:02:57.458Z

Reserved: 2025-04-16T04:51:24.031Z

Link: CVE-2025-38665

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-08-22T16:15:41.860

Modified: 2025-08-22T18:08:51.663

Link: CVE-2025-38665

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-08-22T00:00:00Z

Links: CVE-2025-38665 - Bugzilla