CVE-2026-63990

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

bonding: refuse to enslave CAN devices

syzbot reported a kernel paging request crash in

can_rx_unregister() inside net/can/af_can.c. The crash occurs

because a virtual CAN device (vxcan) is being enslaved to a

bonding master.

During the enslavement process, the bonding driver mutates

and modifies the network device states to fit an Ethernet-like

aggregation model. However, CAN devices operate on a completely

different Layer 2 architecture, relying on the CAN mid-layer

private data structure (can_ml_priv) instead of standard

Ethernet structures. Since bonding does not initialize or

maintain these CAN structures, subsequent operations on the

half-enslaved interface (such as closing associated sockets

via isotp_release) lead to a null-pointer dereference when

accessing the CAN receiver lists.

Bonding CAN interfaces is architecturally invalid as CAN lacks

MAC addresses, ARP capabilities, and standard Ethernet

link-laye

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References