CVE-2025-21775

What it actually does

Missing NULL pointer check after skb allocation failure inside ctucan_err_interrupt() allows dereference of a NULL struct can_frame pointer.

Why it matters to the business

Local attackers can trigger kernel crashes or potential privilege escalation on systems using the ctucanfd CAN controller driver, leading to denial of service or full system compromise.

How an attack unfolds

An attacker on a system with the ctucanfd driver loaded crafts conditions that cause skb allocation to fail during error interrupt handling; the missing NULL check then dereferences the NULL pointer, crashing the kernel or enabling memory corruption for escalation.

How to fix it

Update the Linux kernel to a version containing the NULL check fix for ctucan_err_interrupt(). Apply the patch or upgrade to a fixed kernel release from the distribution vendor.

How to confirm the fix worked

Confirm the presence of the skb allocation NULL check inside ctucan_err_interrupt() by inspecting the driver source or verifying the installed kernel version contains the referenced commit.

Typical attack path

1. Obtain local access to a Linux system exposing the ctucanfd CAN driver
2. Trigger skb allocation failure path in ctucan_err_interrupt()
3. Execute NULL pointer dereference to crash kernel or corrupt memory
4. Leverage resulting corruption for privilege escalation

How to detect it

Review kernel logs for NULL pointer dereference oops in ctucan_err_interrupt or ctucanfd; inspect audit logs for unusual CAN interface activity preceding crashes.

What your security team should do

• Prioritize kernel updates on all systems using ctucanfd hardware
• Monitor for local privilege escalation attempts via CAN error paths
• Restrict unprivileged local access on affected hosts until patched