CVE-2025-71182

What it actually does

Race condition in j1939_session_activate allows the call to succeed after j1939_cancel_active_session has run during NETDEV_UNREGISTER, bypassing the ndev->reg_state check and leaving dangling session references that prevent netdevice cleanup.

Why it matters to the business

Linux systems using J1939 over CAN experience kernel hangs during device removal, leading to operational downtime in embedded, automotive, and industrial environments until reboot.

How an attack unfolds

A local attacker loads the can-j1939 module, opens J1939 sockets, then concurrently triggers session activation while forcing NETDEV_UNREGISTER on a virtual CAN device to exploit the unprotected window between cancellation and state check.

How to fix it

Apply the upstream fix in commit ebb0dfd718dd31c8d3600612ca4b7207ec3d923a; rebuild and deploy the patched kernel across all affected Linux distributions and embedded images.

How to confirm the fix worked

Confirm the patch is present by checking for the added reg_state test under the session list lock in j1939_session_activate; run syzbot-style reproducers and verify that unregister_netdevice completes without waiting.

Typical attack path

1. Gain local user privileges on a Linux system with J1939 enabled
2. Create and register a virtual CAN interface
3. Establish active J1939 sessions
4. Trigger NETDEV_UNREGISTER while racing j1939_session_activate
5. Observe reference count leak preventing interface release

How to detect it

Search kernel logs for repeated 'unregister_netdevice: waiting for ... to become free' messages with non-zero usage counts; inspect J1939 session list manipulation around NETDEV_UNREGISTER events.

• unregister_netdevice: waiting for .* to become free. Usage count = [2-9]
• j1939_session_activate succeeding after NETDEV_UNREGISTER

What your security team should do

• Prioritize kernel upgrade to the fixed commit on all production and edge Linux systems within 30 days
• Disable J1939 module (can-j1939) where CAN is not required
• Monitor for future backports in stable kernel trees
• Add regression tests for netdev unregister races in CI pipelines