---
id: CVE-2025-38665
title: >-
  can: netlink: can_changelink(): fix NULL pointer deref of struct
  can_priv::do_set_mode
summary: >-
  In the Linux kernel, the following vulnerability has been resolved:


  can: netlink: can_changelink(): fix NULL pointer deref of struct
  can_priv::do_set_mode


  Andrei Lalaev reported a NULL pointer deref when a CAN device is

  restarted from …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 39549eef3587f1c1e8c65c88a2400d10fd30ea17 <
    6bbcf37c5114926c99a1d1e6993a5b35689d2599
  - >-
    Linux >= 39549eef3587f1c1e8c65c88a2400d10fd30ea17 <
    cf81a60a973358dea163f6b14062f17831ceb894
  - >-
    Linux >= 39549eef3587f1c1e8c65c88a2400d10fd30ea17 <
    0ca816a96fdcf32644c80cbe7a82c7b6ce6ddda5
  - >-
    Linux >= 39549eef3587f1c1e8c65c88a2400d10fd30ea17 <
    6acceb46180f9e160d4f0c56fcaf39ba562822ae
  - >-
    Linux >= 39549eef3587f1c1e8c65c88a2400d10fd30ea17 <
    c1f3f9797c1f44a762e6f5f72520b2e520537b52
  - Linux 2.6.31
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:06:10.332419Z'
published: '2025-08-22'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:12:51.130Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-38665'
references:
  - url: 'https://git.kernel.org/stable/c/6bbcf37c5114926c99a1d1e6993a5b35689d2599'
  - url: 'https://git.kernel.org/stable/c/cf81a60a973358dea163f6b14062f17831ceb894'
  - url: 'https://git.kernel.org/stable/c/0ca816a96fdcf32644c80cbe7a82c7b6ce6ddda5'
  - url: 'https://git.kernel.org/stable/c/6acceb46180f9e160d4f0c56fcaf39ba562822ae'
  - url: 'https://git.kernel.org/stable/c/c1f3f9797c1f44a762e6f5f72520b2e520537b52'
tags:
  - cve.org
epss: 0.00155
epssPercentile: 0.04631
ingestedAt: '2026-11-05T22:38:32.006Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode

Andrei Lalaev reported a NULL pointer deref when a CAN device is
restarted from Bus Off and the driver does not implement the struct
can_priv::do_set_mode callback.

There are 2 code path that call struct can_priv::do_set_mode:
- directly by a manual restart from the user space, via
  can_changelink()
- delayed automatic restart after bus off (deactivated by default)

To prevent the NULL pointer deference, refuse a manual restart or
configure the automatic restart delay in can_changelink() and report
the error via extack to user space.

As an additional safety measure let can_restart() return an error if
can_priv::do_set_mode is not set instead of dereferencing it
unchecked.

## Affected

- `Linux >= 39549eef3587f1c1e8c65c88a2400d10fd30ea17 < 6bbcf37c5114926c99a1d1e6993a5b35689d2599`
- `Linux >= 39549eef3587f1c1e8c65c88a2400d10fd30ea17 < cf81a60a973358dea163f6b14062f17831ceb894`
- `Linux >= 39549eef3587f1c1e8c65c88a2400d10fd30ea17 < 0ca816a96fdcf32644c80cbe7a82c7b6ce6ddda5`
- `Linux >= 39549eef3587f1c1e8c65c88a2400d10fd30ea17 < 6acceb46180f9e160d4f0c56fcaf39ba562822ae`
- `Linux >= 39549eef3587f1c1e8c65c88a2400d10fd30ea17 < c1f3f9797c1f44a762e6f5f72520b2e520537b52`
- `Linux 2.6.31`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.