CVE-2023-2166

What it actually does

Null pointer dereference in net/can/af_can.c receive path when ml_priv is uninitialized, resulting in kernel panic or denial of service.

Why it matters to the business

Local users can crash affected Linux systems causing operational downtime; low urgency given stable low EPSS, no KEV listing, and publication over three years ago.

How an attack unfolds

An attacker with local access crafts and injects CAN frames that traverse the uninitialized ml_priv path in the kernel CAN receive handler, triggering the dereference and system crash. No named threat actors have been tied to exploitation of this specific issue despite generic mentions of Linux kernel campaigns.

How to fix it

Upgrade the Linux kernel to a version containing the fix for the uninitialized ml_priv handling in the CAN receive path.

How to confirm the fix worked

Verify kernel source or running version includes the commit that properly initializes ml_priv before use in af_can.c receive handling; test by attempting to exercise CAN receive after applying the update.

Typical attack path

1. Gain local shell or process execution on target Linux host
2. Ensure CAN protocol stack is loaded or activate it
3. Transmit malicious CAN frames to exercise the receive path in af_can.c
4. Trigger kernel panic via null dereference

How to detect it

Examine kernel logs for null pointer dereference oops messages involving af_can.c or can protocol; correlate with CAN socket usage by local processes.

What your security team should do

• Prioritize patching on systems that expose CAN interfaces even locally
• Review and restrict local user access to CAN sockets where possible
• Monitor for future Linux kernel updates addressing memory corruption issues