CVE-2025-38665 in Linux
Summary
by MITRE • 08/22/2025
In the Linux kernel, the following vulnerability has been resolved:
can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode
Andrei Lalaev reported a NULL pointer deref when a CAN device is restarted from Bus Off and the driver does not implement the struct can_priv::do_set_mode callback.
There are 2 code path that call struct can_priv::do_set_mode: - directly by a manual restart from the user space, via can_changelink() - delayed automatic restart after bus off (deactivated by default)
To prevent the NULL pointer deference, refuse a manual restart or configure the automatic restart delay in can_changelink() and report the error via extack to user space.
As an additional safety measure let can_restart() return an error if can_priv::do_set_mode is not set instead of dereferencing it unchecked.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 02/14/2026
This vulnerability exists within the Linux kernel's CAN (Controller Area Network) subsystem where a NULL pointer dereference occurs during device state management operations. The issue specifically affects the can_changelink() function which handles configuration changes for CAN devices. When a CAN device transitions from Bus Off state back to operational status, the kernel attempts to invoke the do_set_mode callback function within the can_priv structure. However, when this callback is not implemented by the specific driver, the function pointer remains NULL, leading to a kernel crash upon dereference.
The vulnerability manifests in two distinct operational paths that attempt to utilize the do_set_mode callback function. The first path occurs when userspace manually triggers a device restart through the can_changelink() interface, while the second path involves automatic restart mechanisms that activate after a Bus Off event. Both scenarios assume the presence of a valid callback function without proper validation, creating an exploitable condition where kernel memory access violations can occur. This represents a classic null pointer dereference vulnerability that can lead to system instability and potential privilege escalation.
The operational impact of this vulnerability extends beyond simple system crashes to potentially compromise the integrity of embedded automotive and industrial control systems that rely heavily on CAN bus communications. When a CAN device fails to properly implement the required callback interface, the kernel's handling of device state transitions becomes unpredictable, potentially causing cascading failures in networked systems. This vulnerability affects systems where CAN devices are managed through standard kernel interfaces, particularly in automotive applications, industrial automation, and embedded systems where real-time communication reliability is critical.
The kernel developers have implemented a dual-layered mitigation approach to address this vulnerability. The primary fix modifies can_changelink() to validate the presence of the do_set_mode callback before attempting to invoke it, explicitly rejecting manual restart requests when the callback is absent and reporting appropriate error codes through the extack mechanism to user space. Additionally, the can_restart() function has been enhanced to return explicit error codes when the do_set_mode callback is not properly configured, preventing the unchecked dereference that previously led to kernel panics. This solution aligns with common security practices for preventing null pointer dereferences and follows established patterns in kernel security hardening.
This vulnerability can be categorized under CWE-476 as a NULL Pointer Dereference, and it relates to the broader category of kernel memory safety issues. The attack surface is primarily through legitimate kernel interfaces that should not be exploitable by malicious actors but represent a failure in proper input validation and defensive programming. From an ATT&CK perspective, this vulnerability could be leveraged in privilege escalation scenarios if exploited in kernel space, though it requires specific conditions involving CAN device management operations. The fix demonstrates proper defensive programming techniques that align with security best practices for kernel development and emphasizes the importance of callback validation in kernel subsystems. Organizations should ensure kernel updates are applied promptly to address this vulnerability and maintain system stability in environments where CAN bus communication is critical.