CVE-2025-39985

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow

Sending an PF_PACKET allows to bypass the CAN framework logic and to

directly reach the xmit() function of a CAN driver. The only check

which is performed by the PF_PACKET framework is to make sure that

skb->len fits the interface's MTU.

Unfortunately, because the mcba_usb driver does not populate its

net_device_ops->ndo_change_mtu(), it is possible for an attacker to

configure an invalid MTU by doing, for example:

$ ip link set can0 mtu 9999

After doing so, the attacker could open a PF_PACKET socket using the

ETH_P_CANXL protocol:

socket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL))

to inject a malicious CAN XL frames. For example:

struct canxl_frame frame = {

.flags = 0xff,

.len = 2048,

};

The CAN drivers' xmit() function are calling can_dev_dropped_skb() to

check that the skb is valid, unfortunately under above conditions, the

malicious

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References