CVE-2025-39985

What it actually does

Missing ndo_change_mtu implementation in mcba_usb CAN driver allows MTU to be set above CAN_MTU; PF_PACKET sockets with ETH_P_CANXL then deliver CAN XL frames that bypass can_dev_dropped_skb checks, causing mcba_usb_start_xmit to treat the flags field as cf->len and perform an unchecked memcpy that overflows a fixed-size buffer by up to 247 bytes.

Why it matters to the business

Systems using the mcba_usb driver (embedded, automotive, industrial Linux) face kernel memory corruption that can produce crashes, denial of service, or potential local privilege escalation; the issue affects SUSE Linux Enterprise Server kernels and mainline stable trees, requiring prompt patching to avoid operational disruption in CAN-based environments.

How an attack unfolds

An attacker with local access first raises the CAN interface MTU beyond the valid limit, opens a raw PF_PACKET socket using ETH_P_CANXL, then transmits a crafted CAN XL frame whose flags field is interpreted as an oversized length; the driver copies that many bytes without bounds checking, resulting in a buffer overflow. Related privilege-escalation techniques observed in VMSCAPE and container-optimized OS campaigns could be chained after the overflow.

How to fix it

Apply the upstream fix (commit 0fa9303c4b9493727e0d3a6ac3729300e3013930) or the corresponding SUSE kgraft-patch-SLE12-SP1_Update_19 (version 10-2.1) that populates ndo_change_mtu to enforce CAN_MTU; rebuild and reboot into the patched kernel on all affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit 0fa9303c4b9493727e0d3a6ac3729300e3013930 or the SUSE 10-2.1 patch; verify that ip link set ... mtu rejects values > CAN_MTU on CAN interfaces and that can_dev_dropped_skb now correctly rejects ETH_P_CANXL frames on non-CAN-XL devices.

Typical attack path

1. Configure an invalid MTU (e.g., 9999) on the CAN interface via ip link
2. Create a PF_PACKET/SOCK_RAW socket bound to ETH_P_CANXL
3. Craft a canxl_frame with an oversized flags/len value and transmit it
4. Trigger mcba_usb_start_xmit which performs the unchecked memcpy

How to detect it

Review kernel logs and audit records for mcba_usb_start_xmit entries, unexpected CAN interface MTU changes, socket creations using ETH_P_CANXL, and any subsequent oops or panic messages referencing the mcba_usb module; correlate with process execution of ip or socket utilities around the time of a crash.

• mcba_usb_start_xmit
• ETH_P_CANXL
• canxl_frame
• usb_msg.dlc = cf->len
• memcpy(usb_msg.data, cf->data, usb_msg.dlc)

What your security team should do

• Immediately upgrade all systems exposing the mcba_usb driver to the listed fixed versions
• Restrict unprivileged users from creating PF_PACKET sockets or modifying CAN interface MTU via SELinux/AppArmor or capabilities
• Monitor kernel logs for mcba_usb crashes or buffer-overrun signatures and enable CONFIG_CAN_DEBUG_DEVICES during testing