In the Linux kernel, the following vulnerability has been resolved:
bonding: refuse to enslave CAN devices
syzbot reported a kernel paging request crash in
can_rx_unregister() inside net/can/af_can.c. The crash occurs
because a virtual CAN device (vxcan) is being enslaved to a
bonding master.
During the enslavement process, the bonding driver mutates
and modifies the network device states to fit an Ethernet-like
aggregation model. However, CAN devices operate on a completely
different Layer 2 architecture, relying on the CAN mid-layer
private data structure (can_ml_priv) instead of standard
Ethernet structures. Since bonding does not initialize or
maintain these CAN structures, subsequent operations on the
half-enslaved interface (such as closing associated sockets
via isotp_release) lead to a null-pointer dereference when
accessing the CAN receiver lists.
Bonding CAN interfaces is architecturally invalid as CAN lacks
MAC addresses, ARP capabilities, and standard Ethernet
link-layer mechanisms. While generic loopback devices are
blocked globally in net/core/dev.c, virtual CAN devices
bypass this check because they do not carry the IFF_LOOPBACK
flag, despite acting as local software-loopbacks.
Fix this by explicitly blocking network devices of type
ARPHRD_CAN from being enslaved at the very beginning of
bond_enslave(). This prevents illegal state mutations,
eliminates the resulting KASAN crashes, and avoids potential
memory leaks from incomplete socket cleanups.
As the CAN support has been added a long time after bonding
the Fixes-tag points to the introduction of ARPHRD_CAN that
would have needed a specific handling in bonding_main.c.
References
Configurations
Configuration 1 (hide)
|
History
08 Oct 2026, 14:41
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-476 |
07 Oct 2026, 20:31
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* |
|
| References | () https://git.kernel.org/stable/c/02f1c87ded33b43d48b4a1d665da15f2157b30d8 - Patch | |
| References | () https://git.kernel.org/stable/c/41e8478c4cd896d3abbe33d41afc90c84ac66602 - Patch | |
| References | () https://git.kernel.org/stable/c/563090e5d450c665f70d955a39f9587afc7842eb - Patch | |
| References | () https://git.kernel.org/stable/c/69b78b5f3033272e53a2dc2dad675962654a5b38 - Patch | |
| References | () https://git.kernel.org/stable/c/8ba68464e4787b6a7ec938826e16124df20fd23d - Patch | |
| References | () https://git.kernel.org/stable/c/9ea8a648d9120f7652bcde1ce2c4ad66871af707 - Patch | |
| References | () https://git.kernel.org/stable/c/f4d78a81f57df82e9d82a2c07471fed1a1235893 - Patch | |
| CWE | CWE-401 | |
| First Time |
Linux
Linux linux Kernel |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
Information
Published : 2026-07-19 16:17
Updated : 2026-10-08 14:41
NVD link : CVE-2026-63990
Mitre link : CVE-2026-63990
CVE.ORG link : CVE-2026-63990
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-476
NULL Pointer Dereference