{"id":"CVE-2025-38665","title":"can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ncan: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode\n\nAndrei Lalaev reported a NULL pointer deref when a CAN device is\nrestarted from …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 39549eef3587f1c1e8c65c88a2400d10fd30ea17 < 6bbcf37c5114926c99a1d1e6993a5b35689d2599","Linux >= 39549eef3587f1c1e8c65c88a2400d10fd30ea17 < cf81a60a973358dea163f6b14062f17831ceb894","Linux >= 39549eef3587f1c1e8c65c88a2400d10fd30ea17 < 0ca816a96fdcf32644c80cbe7a82c7b6ce6ddda5","Linux >= 39549eef3587f1c1e8c65c88a2400d10fd30ea17 < 6acceb46180f9e160d4f0c56fcaf39ba562822ae","Linux >= 39549eef3587f1c1e8c65c88a2400d10fd30ea17 < c1f3f9797c1f44a762e6f5f72520b2e520537b52","Linux 2.6.31"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T21:06:10.332419Z"},"published":"2025-08-22","updated":"2026-11-05","sourceUpdated":"2026-11-05T21:12:51.130Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-38665","references":[{"url":"https://git.kernel.org/stable/c/6bbcf37c5114926c99a1d1e6993a5b35689d2599"},{"url":"https://git.kernel.org/stable/c/cf81a60a973358dea163f6b14062f17831ceb894"},{"url":"https://git.kernel.org/stable/c/0ca816a96fdcf32644c80cbe7a82c7b6ce6ddda5"},{"url":"https://git.kernel.org/stable/c/6acceb46180f9e160d4f0c56fcaf39ba562822ae"},{"url":"https://git.kernel.org/stable/c/c1f3f9797c1f44a762e6f5f72520b2e520537b52"}],"tags":["cve.org"],"epss":0.00155,"epssPercentile":0.04631,"ingestedAt":"2026-11-05T22:38:32.006Z","slug":"CVE-2025-38665","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncan: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode\n\nAndrei Lalaev reported a NULL pointer deref when a CAN device is\nrestarted from Bus Off and the driver does not implement the struct\ncan_priv::do_set_mode callback.\n\nThere are 2 code path that call struct can_priv::do_set_mode:\n- directly by a manual restart from the user space, via\n  can_changelink()\n- delayed automatic restart after bus off (deactivated by default)\n\nTo prevent the NULL pointer deference, refuse a manual restart or\nconfigure the automatic restart delay in can_changelink() and report\nthe error via extack to user space.\n\nAs an additional safety measure let can_restart() return an error if\ncan_priv::do_set_mode is not set instead of dereferencing it\nunchecked.\n\n## Affected\n\n- `Linux >= 39549eef3587f1c1e8c65c88a2400d10fd30ea17 < 6bbcf37c5114926c99a1d1e6993a5b35689d2599`\n- `Linux >= 39549eef3587f1c1e8c65c88a2400d10fd30ea17 < cf81a60a973358dea163f6b14062f17831ceb894`\n- `Linux >= 39549eef3587f1c1e8c65c88a2400d10fd30ea17 < 0ca816a96fdcf32644c80cbe7a82c7b6ce6ddda5`\n- `Linux >= 39549eef3587f1c1e8c65c88a2400d10fd30ea17 < 6acceb46180f9e160d4f0c56fcaf39ba562822ae`\n- `Linux >= 39549eef3587f1c1e8c65c88a2400d10fd30ea17 < c1f3f9797c1f44a762e6f5f72520b2e520537b52`\n- `Linux 2.6.31`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}