CVE-2025-39988

What it actually does

Missing ndo_change_mtu implementation in etas_es58x CAN driver allows invalid MTU configuration; PF_PACKET sockets with ETH_P_CANXL can inject CAN XL frames that bypass can_dev_dropped_skb checks and are misinterpreted as CAN(FD) frames, leading to oversized memcpy in es581_4_tx_can_msg and similar paths causing buffer overflow.

Why it matters to the business

Local attackers with interface configuration rights can trigger kernel memory corruption on systems using affected CAN hardware (automotive/industrial), risking crashes, privilege escalation, or denial of service; low EPSS and no KEV status indicate limited real-world exploitation urgency despite 377 days since publication.

How an attack unfolds

Attacker configures oversized MTU on CAN interface (e.g., ip link set can0 mtu 9999), opens PF_PACKET socket with ETH_P_CANXL, crafts CAN XL frame with large flags/len values, injects via raw socket; frame reaches es58x_start_xmit where it is mishandled as CAN(FD) resulting in overflow during memcpy of cf->data using cf->len derived from flags.

How to fix it

Upgrade affected Ubuntu kernels to the listed fixed versions: linux 5.13.0-19.19 (22.04), linux-aws 5.13.0-1005.6, linux-azure 5.13.0-1006.7, linux-gcp 5.13.0-1005.6 and equivalent per-package fixes for 20.04/18.04 variants (e.g., linux-aws-5.15 5.15.0-1014.18~20.04.1). Reboot after upgrade; restrict unprivileged MTU changes via policy where possible.

How to confirm the fix worked

Verify running kernel version matches or exceeds a fixed package; confirm net_device_ops ndo_change_mtu enforces CAN_MTU/CANFD_MTU limits; test interface MTU setting rejects values > device capability and that can_is_canfd_skb path rejects CAN XL frames.

Typical attack path

1. Configure invalid MTU exceeding CAN_MTU/CANFD_MTU on target CAN interface
2. Create PF_PACKET SOCK_RAW socket bound to ETH_P_CANXL
3. Craft and transmit malicious canxl_frame with elevated flags/len
4. Trigger driver xmit path that misinterprets frame and performs unbounded memcpy

How to detect it

Search kernel logs and audit records for CAN interface MTU modifications, creation of PF_PACKET sockets using ETH_P_CANXL, and oops/panic traces referencing etas_es58x functions such as es58x_start_xmit or es581_4_tx_can_msg; correlate with container or privilege-escalation attempts noted in related threat actor activity.

• es58x_start_xmit
• es581_4_tx_can_msg
• ETH_P_CANXL
• ndo_change_mtu

What your security team should do

• Prioritize kernel package upgrades on any system exposing CAN interfaces
• Audit and restrict CAP_NET_ADMIN privileges for untrusted users/containers
• Monitor for unexpected changes to CAN interface MTU settings in system logs
• Disable unused CAN drivers via kernel config if hardware not required