CVE-2025-39987

What it actually does

Missing ndo_change_mtu() implementation in hi311x CAN driver allows PF_PACKET sockets to set an MTU larger than CAN_MTU, bypassing can_dev_dropped_skb() checks and passing CAN XL frames that trigger an unchecked memcpy() of up to 247 bytes in hi3110_hw_tx().

Why it matters to the business

Kernel memory corruption on embedded or automotive Linux systems using the hi311x controller can lead to crashes, denial of service, or potential privilege escalation; urgency is moderate given low EPSS and absence from KEV or ransomware campaigns, though the flaw affects stable kernel trees and SUSE LTSS packages.

How an attack unfolds

An attacker configures an oversized MTU on the CAN interface via ip link, opens a PF_PACKET raw socket with ETH_P_CANXL, crafts a canxl_frame with large len/flags values, and injects it; the driver misinterprets the frame and performs an out-of-bounds memcpy without further validation.

How to fix it

Apply the upstream fix (commit f2c247e9581024d8b3dd44cbe086bf2bebbef42c) or the equivalent SUSE kgraft-patch-SLE12_Update_27 (version 9-2.1) that populates ndo_change_mtu() to enforce CAN_MTU; rebuild and reboot into the patched kernel.

How to confirm the fix worked

After patching, confirm that ip link set <iface> mtu <value> rejects values > CAN_MTU and that the net_device_ops structure contains a populated ndo_change_mtu handler; re-test by attempting the PF_PACKET injection path.

Typical attack path

1. Locate a system exposing a hi311x CAN netdevice
2. Run ip link set <iface> mtu 9999 or larger
3. Create PF_PACKET/SOCK_RAW socket bound to ETH_P_CANXL
4. Send canxl_frame with len/flags exceeding CAN_MTU
5. Trigger buffer overflow in hi3110_hard_start_xmit() and hi3110_hw_tx()

How to detect it

Search kernel logs and audit trails for MTU modifications on CAN interfaces, socket creations using ETH_P_CANXL, and calls into hi3110_hard_start_xmit(); correlate with process activity creating raw PF_PACKET sockets.

• ip link set .* mtu (9[0-9]{3}|[1-9][0-9]{4,})
• socket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL))
• hi3110_hard_start_xmit
• memcpy.*HI3110_FIFO_EXT_DATA_OFF

What your security team should do

• Patch affected kernels within normal change windows given low EPSS and no KEV listing
• Restrict CAP_NET_ADMIN and PF_PACKET usage on systems with CAN interfaces
• Monitor kernel logs for MTU changes on CAN devices and unexpected ETH_P_CANXL traffic
• Audit downstream dependents of the linux.git tree for additional exposure