CVE-2021-46994

What it actually does

Null pointer dereference triggered on resume from suspend when the CAN interface has not been brought up, because restart_work is queued before the workqueue is allocated in mcp251x_open().

Why it matters to the business

Systems using the mcp251x CAN controller may experience kernel crashes or panics during resume from sleep if the interface was never enabled, leading to unexpected downtime and loss of CAN bus functionality.

How an attack unfolds

An attacker with local access or the ability to induce suspend/resume cycles on a system with the vulnerable driver loaded but the interface down can trigger the resume path that queues restart_work on an uninitialized workqueue, causing a kernel null dereference.

How to fix it

Apply the upstream fix that moves workqueue initialization into mcp251x_can_probe() and update to a kernel containing the resolution of this issue; disable the driver or avoid suspend/resume if immediate patching is not possible.

How to confirm the fix worked

Verify the presence of the corrected probe function initialization and absence of the restart_work queuing path on early resume; test suspend/resume cycles with the interface left down and confirm no null dereference occurs.

Typical attack path

1. Load the mcp251x driver without calling mcp251x_open() to bring the interface up
2. Trigger system suspend followed by resume
3. Kernel resumes and queues priv->restart_work before the workqueue exists
4. Null dereference occurs and the kernel panics or oopses

How to detect it

Search kernel logs and dmesg for mcp251x null pointer dereference or workqueue-related oops messages occurring immediately after resume events; correlate with driver load without prior open calls.

• mcp251x_restart_work
• NULL pointer dereference in mcp251x
• workqueue not initialized before resume

What your security team should do

• Prioritize kernel updates on any systems using the mcp251x driver
• Review device configurations to ensure interfaces are brought up only when needed
• Monitor kernel logs for mcp251x-related oopses during resume events