GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-38665 (GCVE-0-2025-38665)

Vulnerability from cvelistv5 – Published: 2025-08-22 16:02 – Updated: 2026-05-11 21:32
VLAI
Title
can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode
Summary
In the Linux kernel, the following vulnerability has been resolved: can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode Andrei Lalaev reported a NULL pointer deref when a CAN device is restarted from Bus Off and the driver does not implement the struct can_priv::do_set_mode callback. There are 2 code path that call struct can_priv::do_set_mode: - directly by a manual restart from the user space, via can_changelink() - delayed automatic restart after bus off (deactivated by default) To prevent the NULL pointer deference, refuse a manual restart or configure the automatic restart delay in can_changelink() and report the error via extack to user space. As an additional safety measure let can_restart() return an error if can_priv::do_set_mode is not set instead of dereferencing it unchecked.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 39549eef3587f1c1e8c65c88a2400d10fd30ea17 , < 6bbcf37c5114926c99a1d1e6993a5b35689d2599 (git)
Affected: 39549eef3587f1c1e8c65c88a2400d10fd30ea17 , < cf81a60a973358dea163f6b14062f17831ceb894 (git)
Affected: 39549eef3587f1c1e8c65c88a2400d10fd30ea17 , < 0ca816a96fdcf32644c80cbe7a82c7b6ce6ddda5 (git)
Affected: 39549eef3587f1c1e8c65c88a2400d10fd30ea17 , < 6acceb46180f9e160d4f0c56fcaf39ba562822ae (git)
Affected: 39549eef3587f1c1e8c65c88a2400d10fd30ea17 , < c1f3f9797c1f44a762e6f5f72520b2e520537b52 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.31
Unaffected: 0 , < 2.6.31 (semver)
Unaffected: 6.1.148 , ≤ 6.1.* (semver)
Unaffected: 6.6.101 , ≤ 6.6.* (semver)
Unaffected: 6.12.41 , ≤ 6.12.* (semver)
Unaffected: 6.15.9 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:40:51.309Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/dev/dev.c",
            "drivers/net/can/dev/netlink.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6bbcf37c5114926c99a1d1e6993a5b35689d2599",
              "status": "affected",
              "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
              "versionType": "git"
            },
            {
              "lessThan": "cf81a60a973358dea163f6b14062f17831ceb894",
              "status": "affected",
              "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
              "versionType": "git"
            },
            {
              "lessThan": "0ca816a96fdcf32644c80cbe7a82c7b6ce6ddda5",
              "status": "affected",
              "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
              "versionType": "git"
            },
            {
              "lessThan": "6acceb46180f9e160d4f0c56fcaf39ba562822ae",
              "status": "affected",
              "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
              "versionType": "git"
            },
            {
              "lessThan": "c1f3f9797c1f44a762e6f5f72520b2e520537b52",
              "status": "affected",
              "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/dev/dev.c",
            "drivers/net/can/dev/netlink.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.31"
            },
            {
              "lessThan": "2.6.31",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.41",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.148",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.101",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.41",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.9",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode\n\nAndrei Lalaev reported a NULL pointer deref when a CAN device is\nrestarted from Bus Off and the driver does not implement the struct\ncan_priv::do_set_mode callback.\n\nThere are 2 code path that call struct can_priv::do_set_mode:\n- directly by a manual restart from the user space, via\n  can_changelink()\n- delayed automatic restart after bus off (deactivated by default)\n\nTo prevent the NULL pointer deference, refuse a manual restart or\nconfigure the automatic restart delay in can_changelink() and report\nthe error via extack to user space.\n\nAs an additional safety measure let can_restart() return an error if\ncan_priv::do_set_mode is not set instead of dereferencing it\nunchecked."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:32:36.485Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6bbcf37c5114926c99a1d1e6993a5b35689d2599"
        },
        {
          "url": "https://git.kernel.org/stable/c/cf81a60a973358dea163f6b14062f17831ceb894"
        },
        {
          "url": "https://git.kernel.org/stable/c/0ca816a96fdcf32644c80cbe7a82c7b6ce6ddda5"
        },
        {
          "url": "https://git.kernel.org/stable/c/6acceb46180f9e160d4f0c56fcaf39ba562822ae"
        },
        {
          "url": "https://git.kernel.org/stable/c/c1f3f9797c1f44a762e6f5f72520b2e520537b52"
        }
      ],
      "title": "can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38665",
    "datePublished": "2025-08-22T16:02:57.458Z",
    "dateReserved": "2025-04-16T04:51:24.031Z",
    "dateUpdated": "2026-05-11T21:32:36.485Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38665",
      "date": "2026-09-16",
      "epss": "0.00149",
      "percentile": "0.04436"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-12T01:46:38.000Z",
      "cve": "CVE-2025-38665",
      "id": "msrc_CVE-2025-38665",
      "initial_release_date": "2025-09-03T22:16:52.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "6",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38665.json",
      "version": "5"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38665\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-08-22T16:15:41.860\",\"lastModified\":\"2026-06-17T09:17:36.153\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncan: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode\\n\\nAndrei Lalaev reported a NULL pointer deref when a CAN device is\\nrestarted from Bus Off and the driver does not implement the struct\\ncan_priv::do_set_mode callback.\\n\\nThere are 2 code path that call struct can_priv::do_set_mode:\\n- directly by a manual restart from the user space, via\\n  can_changelink()\\n- delayed automatic restart after bus off (deactivated by default)\\n\\nTo prevent the NULL pointer deference, refuse a manual restart or\\nconfigure the automatic restart delay in can_changelink() and report\\nthe error via extack to user space.\\n\\nAs an additional safety measure let can_restart() return an error if\\ncan_priv::do_set_mode is not set instead of dereferencing it\\nunchecked.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: can: netlink: can_changelink(): corrige la desreferencia del puntero NULL de struct can_priv::do_set_mode Andrei Lalaev inform\u00f3 de una desreferencia del puntero NULL cuando un dispositivo CAN se reinicia desde Bus Off y el controlador no implementa la devoluci\u00f3n de llamada struct can_priv::do_set_mode. Hay 2 rutas de c\u00f3digo que llaman a struct can_priv::do_set_mode: - directamente mediante un reinicio manual desde el espacio de usuario, a trav\u00e9s de can_changelink() - reinicio autom\u00e1tico retrasado despu\u00e9s de apagar el bus (desactivado de forma predeterminada) Para evitar la deferencia del puntero NULL, rechace un reinicio manual o configure el retraso del reinicio autom\u00e1tico en can_changelink() e informe del error a trav\u00e9s de extack al espacio de usuario. Como medida de seguridad adicional, deje que can_restart() devuelva un error si can_priv::do_set_mode no est\u00e1 configurado en lugar de desreferenciarlo sin marcar.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/can/dev/dev.c\",\"drivers/net/can/dev/netlink.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"39549eef3587f1c1e8c65c88a2400d10fd30ea17\",\"lessThan\":\"6bbcf37c5114926c99a1d1e6993a5b35689d2599\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"39549eef3587f1c1e8c65c88a2400d10fd30ea17\",\"lessThan\":\"cf81a60a973358dea163f6b14062f17831ceb894\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"39549eef3587f1c1e8c65c88a2400d10fd30ea17\",\"lessThan\":\"0ca816a96fdcf32644c80cbe7a82c7b6ce6ddda5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"39549eef3587f1c1e8c65c88a2400d10fd30ea17\",\"lessThan\":\"6acceb46180f9e160d4f0c56fcaf39ba562822ae\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"39549eef3587f1c1e8c65c88a2400d10fd30ea17\",\"lessThan\":\"c1f3f9797c1f44a762e6f5f72520b2e520537b52\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/can/dev/dev.c\",\"drivers/net/can/dev/netlink.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.31\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.31\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.148\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.101\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.41\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.9\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.31\",\"versionEndExcluding\":\"6.1.148\",\"matchCriteriaId\":\"B513B9FF-CF69-40D9-B9CC-E4B571DBB42C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.101\",\"matchCriteriaId\":\"686C7A1C-35F3-495D-9825-94B5BCED2705\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.41\",\"matchCriteriaId\":\"7B9B92B6-A7E5-4697-AB94-8432ED55AA05\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.9\",\"matchCriteriaId\":\"656D6B8C-4D7B-4385-98B6-44EA4AFADD2E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D4894DB-CCFE-4602-B1BF-3960B2E19A01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"09709862-E348-4378-8632-5A7813EDDC86\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"415BF58A-8197-43F5-B3D7-D1D63057A26E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A0517869-312D-4429-80C2-561086E1421C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"85421F4E-C863-4ABF-B4B4-E887CC2F7F92\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"3827F0D4-5FEE-4181-B267-5A45E7CA11FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"7A9C2DE5-43B8-4D73-BDB5-EA55C7671A52\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0ca816a96fdcf32644c80cbe7a82c7b6ce6ddda5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6acceb46180f9e160d4f0c56fcaf39ba562822ae\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6bbcf37c5114926c99a1d1e6993a5b35689d2599\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c1f3f9797c1f44a762e6f5f72520b2e520537b52\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cf81a60a973358dea163f6b14062f17831ceb894\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-30T01:14:19+00:00",
      "cve": "CVE-2025-38665",
      "id": "CVE-2025-38665",
      "initial_release_date": "2025-08-22T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38665.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-28T16:59:38Z",
      "cve": "CVE-2025-38665",
      "id": "CVE-2025-38665",
      "initial_release_date": "2025-08-22T23:28:14Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "739",
      "product_status:known_not_affected": "64",
      "product_status:recommended": "495",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38665",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38665.json",
      "version": "59"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.