CVE-2024-46791

What it actually does

The mcp251x_hw_wake function holds the mcp_lock mutex while calling disable_irq, but an already-pending interrupt can cause the threaded handler mcp251x_can_ist to block on the same mutex, producing a deadlock.

Why it matters to the business

Systems using the mcp251x CAN controller may experience kernel hangs or forced reboots during device initialization, disrupting CAN-bus dependent operations in automotive, industrial, or embedded environments; the large number of downstream Linux kernel users increases exposure.

How an attack unfolds

An attacker with local access triggers the race by opening the CAN device while an interrupt is already pending; the kernel path acquires the mutex, requests the threaded IRQ, and then calls disable_irq, deadlocking with the handler that also needs the mutex. No named threat actors are known to have used this specific flaw.

How to fix it

Update the Linux kernel to a version containing commit 3a49b6b1caf5cefc05264d29079d52c99cb188e0 or later; rebuild and deploy the fixed kernel image, then reboot affected systems. For stable trees, apply the backported fix corresponding to the affected release.

How to confirm the fix worked

Confirm the running kernel contains commit 3a49b6b1caf5cefc05264d29079d52c99cb188e0 or equivalent; attempt to reproduce the open-during-interrupt scenario in a test environment and verify the system no longer deadlocks.

Typical attack path

1. Obtain local execution on a system with the mcp251x driver loaded
2. Open the CAN interface while ensuring an interrupt is already queued
3. Trigger the open path that acquires mcp_lock and then disable_irq
4. Cause the interrupt handler to contend for the same mutex, resulting in deadlock

How to detect it

Examine kernel logs for repeated mcp251x open sequences immediately followed by soft lockup or hung-task reports; look for processes stuck in mutex acquisition inside mcp251x_can_ist or mcp251x_hw_wake.

What your security team should do

• Prioritize kernel updates on all systems exposing the mcp251x driver within the next maintenance window
• Review CAN-bus device initialization code for similar locking patterns
• Monitor upstream stable kernel releases for additional related fixes