CVE-2025-39985
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow Sending an PF_PACKET allows to bypass the CAN framework logic and to directly reach the xmit() function of a CAN driver. The only check which is performed by the PF_PACKET framework is to make sure that skb->len fits the interface's MTU. Unfortunately, because the mcba_usb driver does not populate its net_device_ops->ndo_change_mtu(), it is possible for an attacker to configure an invalid MTU by doing, for example: $ ip link set can0 mtu 9999 After doing so, the attacker could open a PF_PACKET socket using the ETH_P_CANXL protocol: socket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL)) to inject a malicious CAN XL frames. For example: struct canxl_frame frame = { .flags = 0xff, .len = 2048, }; The CAN drivers' xmit() function are calling can_dev_dropped_skb() to check that the skb is valid, unfortunately under above conditions, the malicious packet is able to go through can_dev_dropped_skb() checks: 1. the skb->protocol is set to ETH_P_CANXL which is valid (the function does not check the actual device capabilities). 2. the length is a valid CAN XL length. And so, mcba_usb_start_xmit() receives a CAN XL frame which it is not able to correctly handle and will thus misinterpret it as a CAN frame. This can result in a buffer overflow. The driver will consume cf->len as-is with no further checks on these lines: usb_msg.dlc = cf->len; memcpy(usb_msg.data, cf->data, usb_msg.dlc); Here, cf->len corresponds to the flags field of the CAN XL frame. In our previous example, we set canxl_frame->flags to 0xff. Because the maximum expected length is 8, a buffer overflow of 247 bytes occurs! Populate net_device_ops->ndo_change_mtu() to ensure that the interface's MTU can not be set to anything bigger than CAN_MTU. By fixing the root cause, this prevents the buffer overflow.
Severity
HIGH
CVSS score
7.8
(v3.1)
Vulnerability status
Deferred
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2025-10-15 08:15:36.523000
Last modified
2026-10-19 21:10:00.160000
View original CVE JSON
{
"id": "CVE-2025-39985",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-15T08:15:36.523",
"lastModified": "2026-10-19T21:10:00.160",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow\n\nSending an PF_PACKET allows to bypass the CAN framework logic and to\ndirectly reach the xmit() function of a CAN driver. The only check\nwhich is performed by the PF_PACKET framework is to make sure that\nskb->len fits the interface's MTU.\n\nUnfortunately, because the mcba_usb driver does not populate its\nnet_device_ops->ndo_change_mtu(), it is possible for an attacker to\nconfigure an invalid MTU by doing, for example:\n\n $ ip link set can0 mtu 9999\n\nAfter doing so, the attacker could open a PF_PACKET socket using the\nETH_P_CANXL protocol:\n\n\tsocket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL))\n\nto inject a malicious CAN XL frames. For example:\n\n\tstruct canxl_frame frame = {\n\t\t.flags = 0xff,\n\t\t.len = 2048,\n\t};\n\nThe CAN drivers' xmit() function are calling can_dev_dropped_skb() to\ncheck that the skb is valid, unfortunately under above conditions, the\nmalicious packet is able to go through can_dev_dropped_skb() checks:\n\n 1. the skb->protocol is set to ETH_P_CANXL which is valid (the\n function does not check the actual device capabilities).\n\n 2. the length is a valid CAN XL length.\n\nAnd so, mcba_usb_start_xmit() receives a CAN XL frame which it is not\nable to correctly handle and will thus misinterpret it as a CAN frame.\n\nThis can result in a buffer overflow. The driver will consume cf->len\nas-is with no further checks on these lines:\n\n\tusb_msg.dlc = cf->len;\n\n\tmemcpy(usb_msg.data, cf->data, usb_msg.dlc);\n\nHere, cf->len corresponds to the flags field of the CAN XL frame. In\nour previous example, we set canxl_frame->flags to 0xff. Because the\nmaximum expected length is 8, a buffer overflow of 247 bytes occurs!\n\nPopulate net_device_ops->ndo_change_mtu() to ensure that the\ninterface's MTU can not be set to anything bigger than CAN_MTU. By\nfixing the root cause, this prevents the buffer overflow."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncan: mcba_usb: poblar ndo_change_mtu() para prevenir desbordamiento de búfer\n\nEnviar un PF_PACKET permite eludir la lógica del framework CAN y alcanzar directamente la función xmit() de un controlador CAN. La única verificación que realiza el framework PF_PACKET es asegurarse de que skb->len se ajuste a la MTU de la interfaz.\n\nDesafortunadamente, debido a que el controlador mcba_usb no puebla su net_device_ops->ndo_change_mtu(), es posible para un atacante configurar una MTU inválida haciendo, por ejemplo:\n\n $ ip link set can0 mtu 9999\n\nDespués de hacerlo, el atacante podría abrir un socket PF_PACKET usando el protocolo ETH_P_CANXL:\n\n\tsocket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL))\n\npara inyectar tramas CAN XL maliciosas. Por ejemplo:\n\n\tstruct canxl_frame frame = {\n\t\t.flags = 0xff,\n\t\t.len = 2048,\n\t};\n\nLa función xmit() de los controladores CAN está llamando a can_dev_dropped_skb() para verificar que el skb sea válido, desafortunadamente bajo las condiciones anteriores, el paquete malicioso es capaz de pasar las verificaciones de can_dev_dropped_skb():\n\n 1. el skb->protocol está configurado a ETH_P_CANXL, lo cual es válido (la función no verifica las capacidades reales del dispositivo).\n\n 2. la longitud es una longitud CAN XL válida.\n\nY así, mcba_usb_start_xmit() recibe una trama CAN XL que no es capaz de manejar correctamente y, por lo tanto, la malinterpretará como una trama CAN.\n\nEsto puede resultar en un desbordamiento de búfer. El controlador consumirá cf->len tal cual sin más verificaciones en estas líneas:\n\n\tusb_msg.dlc = cf->len;\n\n\tmemcpy(usb_msg.data, cf->data, usb_msg.dlc);\n\nAquí, cf->len corresponde al campo flags de la trama CAN XL. En nuestro ejemplo anterior, configuramos canxl_frame->flags a 0xff. Debido a que la longitud máxima esperada es 8, ¡ocurre un desbordamiento de búfer de 247 bytes!\n\nPoblar net_device_ops->ndo_change_mtu() para asegurar que la MTU de la interfaz no pueda ser configurada a nada mayor que CAN_MTU. Al corregir la causa raíz, esto previene el desbordamiento de búfer."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/net/can/usb/mcba_usb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "51f3baad7de943780ce0c17bd7975df567dd6e14",
"lessThan": "0fa9303c4b9493727e0d3a6ac3729300e3013930",
"versionType": "git",
"status": "affected"
},
{
"version": "51f3baad7de943780ce0c17bd7975df567dd6e14",
"lessThan": "37aed407496bf6de8910e588edb04d2435fa7011",
"versionType": "git",
"status": "affected"
},
{
"version": "51f3baad7de943780ce0c17bd7975df567dd6e14",
"lessThan": "6eec67bfb25637f9b51e584cf59ddace59925bc8",
"versionType": "git",
"status": "affected"
},
{
"version": "51f3baad7de943780ce0c17bd7975df567dd6e14",
"lessThan": "ca4e51359608e1f29bf1f2c33c3ddf775b6b7ed1",
"versionType": "git",
"status": "affected"
},
{
"version": "51f3baad7de943780ce0c17bd7975df567dd6e14",
"lessThan": "3664ae91b26d1fd7e4cee9cde17301361f4c89d5",
"versionType": "git",
"status": "affected"
},
{
"version": "51f3baad7de943780ce0c17bd7975df567dd6e14",
"lessThan": "6b9fb82df8868dbe9ffea5874b8d35f951faedbb",
"versionType": "git",
"status": "affected"
},
{
"version": "51f3baad7de943780ce0c17bd7975df567dd6e14",
"lessThan": "b638c3fb0f163e69785ceddb3b434a9437878bec",
"versionType": "git",
"status": "affected"
},
{
"version": "51f3baad7de943780ce0c17bd7975df567dd6e14",
"lessThan": "17c8d794527f01def0d1c8b7dc2d7b8d34fed0e6",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/net/can/usb/mcba_usb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "4.12",
"status": "affected"
},
{
"version": "0",
"lessThan": "4.12",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.4.300",
"lessThanOrEqual": "5.4.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.245",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.194",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.155",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.109",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.50",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.16.10",
"lessThanOrEqual": "6.16.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.17",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
]
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0fa9303c4b9493727e0d3a6ac3729300e3013930",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/17c8d794527f01def0d1c8b7dc2d7b8d34fed0e6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3664ae91b26d1fd7e4cee9cde17301361f4c89d5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/37aed407496bf6de8910e588edb04d2435fa7011",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6b9fb82df8868dbe9ffea5874b8d35f951faedbb",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6eec67bfb25637f9b51e584cf59ddace59925bc8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b638c3fb0f163e69785ceddb3b434a9437878bec",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ca4e51359608e1f29bf1f2c33c3ddf775b6b7ed1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}