CVE-2025-39986

What it actually does

Missing ndo_change_mtu implementation in sun4i_can allows an attacker-set MTU larger than CAN_MTU; a PF_PACKET socket with ETH_P_CANXL then delivers a CAN XL frame that passes can_dev_dropped_skb checks and is misinterpreted as a CAN frame, causing dlc = cf->len (from flags) to drive an unbounded writel loop and overflow the transmit buffer.

Why it matters to the business

Local attackers on systems exposing CAN interfaces can crash the kernel or achieve privilege escalation, disrupting embedded or automotive Linux deployments and forcing emergency patching across fleets.

How an attack unfolds

An attacker with local access configures an oversized MTU on a CAN interface via ip link, opens a PF_PACKET/SOCK_RAW socket bound to ETH_P_CANXL, crafts a canxl_frame with large flags and len values, and transmits it; the frame bypasses CAN framework validation and triggers the unchecked copy loop inside sun4ican_start_xmit.

How to fix it

Upgrade the Linux kernel to a version containing commit 063539db42203b29d5aa2adf0cae3d68c646a6b6 or later; rebuild and deploy the updated kernel on all affected systems. Where immediate patching is impossible, restrict unprivileged access to CAN interfaces and disable PF_PACKET for non-admin users via seccomp or LSM policy.

How to confirm the fix worked

Verify the running kernel contains commit 063539db42203b29d5aa2adf0cae3d68c646a6b6; confirm sun4i_can net_device_ops now includes a populated ndo_change_mtu handler that rejects MTU > CAN_MTU; attempt the ip link mtu change and observe rejection.

Typical attack path

1. Obtain local shell or container access on the target Linux system
2. Run ip link set <canX> mtu 9999 to set an invalid MTU
3. Create PF_PACKET socket with protocol ETH_P_CANXL
4. Craft and send a malicious canxl_frame via sendto or similar
5. Trigger buffer overflow and potential kernel panic or code execution

How to detect it

Search kernel logs for oops or panic messages containing sun4ican_start_xmit or can_dev_dropped_skb; inspect audit logs for ip link mtu changes on CAN devices and socket creation with ETH_P_CANXL; correlate with process execution of tools that set non-standard MTU values.

What your security team should do

• Prioritize kernel upgrade on any host exposing sun4i_can or similar CAN drivers
• Audit systems for CAN interfaces and remove unnecessary exposure
• Apply seccomp filters or capabilities restrictions to block PF_PACKET usage by untrusted processes
• Monitor for kernel oops or panic logs referencing sun4ican_start_xmit