CVE-2025-38665

What it actually does

NULL pointer dereference in can_changelink() when struct can_priv::do_set_mode is unset during manual or automatic CAN device restart from Bus Off state.

Why it matters to the business

Kernel panic or denial of service on Linux systems using CAN networking hardware whose drivers omit the optional callback, with elevated risk on container-optimized OS deployments.

How an attack unfolds

An attacker with local access triggers a CAN device restart via netlink (manual or delayed automatic) against a driver lacking do_set_mode; the unchecked dereference in can_changelink or can_restart crashes the kernel. Threat actors including VMSCAPE and campaigns targeting Container-Optimized OS have shown interest in similar Linux kernel privilege-escalation vectors.

How to fix it

Upgrade the Linux kernel to commit 6bbcf37c5114926c99a1d1e6993a5b35689d2599 or later; Chainguard openjdk-21-openj9 packages are fixed in 0.53.0-r0 and newer.

How to confirm the fix worked

Confirm kernel contains 6bbcf37c5114926c99a1d1e6993a5b35689d2599; attempt CAN restart on affected driver and verify extack error is returned instead of dereference.

Typical attack path

1. Identify CAN interface whose driver lacks do_set_mode
2. Issue netlink RTM_SETLINK or enable automatic restart delay
3. Trigger Bus Off condition or explicit restart request
4. can_changelink dereferences NULL do_set_mode leading to panic

How to detect it

Search kernel logs for NULL pointer dereference in can_changelink or can_restart around CAN netlink operations; correlate with netlink RTM_SETLINK messages on CAN interfaces.

What your security team should do

• Apply the referenced kernel commit or package update immediately on all CAN-enabled systems
• Disable automatic CAN restart (restart-ms=0) until patched
• Audit CAN drivers for do_set_mode implementation
• Monitor EPSS trend and container-optimized OS exploit activity for related kernel CVEs