CVE-2025-38224

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

can: kvaser_pciefd: refine error prone echo_skb_max handling logic

echo_skb_max should define the supported upper limit of echo_skb[]

allocated inside the netdevice's priv. The corresponding size value

provided by this driver to alloc_candev() is KVASER_PCIEFD_CAN_TX_MAX_COUNT

which is 17.

But later echo_skb_max is rounded up to the nearest power of two (for the

max case, that would be 32) and the tx/ack indices calculated further

during tx/rx may exceed the upper array boundary. Kasan reported this for

the ack case inside kvaser_pciefd_handle_ack_packet(), though the xmit

function has actually caught the same thing earlier.

BUG: KASAN: slab-out-of-bounds in kvaser_pciefd_handle_ack_packet+0x2d7/0x92a drivers/net/can/kvaser_pciefd.c:1528

Read of size 8 at addr ffff888105e4f078 by task swapper/4/0

CPU: 4 UID: 0 PID: 0 Comm: swapper/4 Not tainted 6.15.0 #12 PREEMPT(voluntary)

Call Trace:

<IRQ>

dump_stack_lvl

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References