CVE-2025-39988 (GCVE-0-2025-39988)

Vulnerability from cvelistv5 – Published: 2025-10-15 07:56 – Updated: 2026-08-05 12:06
VLAI
Title
can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow
Summary
In the Linux kernel, the following vulnerability has been resolved: can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow Sending an PF_PACKET allows to bypass the CAN framework logic and to directly reach the xmit() function of a CAN driver. The only check which is performed by the PF_PACKET framework is to make sure that skb->len fits the interface's MTU. Unfortunately, because the etas_es58x driver does not populate its net_device_ops->ndo_change_mtu(), it is possible for an attacker to configure an invalid MTU by doing, for example: $ ip link set can0 mtu 9999 After doing so, the attacker could open a PF_PACKET socket using the ETH_P_CANXL protocol: socket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL)); to inject a malicious CAN XL frames. For example: struct canxl_frame frame = { .flags = 0xff, .len = 2048, }; The CAN drivers' xmit() function are calling can_dev_dropped_skb() to check that the skb is valid, unfortunately under above conditions, the malicious packet is able to go through can_dev_dropped_skb() checks: 1. the skb->protocol is set to ETH_P_CANXL which is valid (the function does not check the actual device capabilities). 2. the length is a valid CAN XL length. And so, es58x_start_xmit() receives a CAN XL frame which it is not able to correctly handle and will thus misinterpret it as a CAN(FD) frame. This can result in a buffer overflow. For example, using the es581.4 variant, the frame will be dispatched to es581_4_tx_can_msg(), go through the last check at the beginning of this function: if (can_is_canfd_skb(skb)) return -EMSGSIZE; and reach this line: memcpy(tx_can_msg->data, cf->data, cf->len); Here, cf->len corresponds to the flags field of the CAN XL frame. In our previous example, we set canxl_frame->flags to 0xff. Because the maximum expected length is 8, a buffer overflow of 247 bytes occurs! Populate net_device_ops->ndo_change_mtu() to ensure that the interface's MTU can not be set to anything bigger than CAN_MTU or CANFD_MTU (depending on the device capabilities). By fixing the root cause, this prevents the buffer overflow.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 7033 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 8537257874e949a59c834cecfd5a063e11b64b0b , < 72de0facc50afdb101fb7197d880407f1abfc77f (git)
Affected: 8537257874e949a59c834cecfd5a063e11b64b0b , < c4e582e686c4d683c87f2b4a316385b3d81d370f (git)
Affected: 8537257874e949a59c834cecfd5a063e11b64b0b , < cbc1de71766f326a44bb798aeae4a7ef4a081cc9 (git)
Affected: 8537257874e949a59c834cecfd5a063e11b64b0b , < b26cccd87dcddc47b450a40f3b1ac3fe346efcff (git)
Affected: 8537257874e949a59c834cecfd5a063e11b64b0b , < e587af2c89ecc6382c518febea52fa9ba81e47c0 (git)
Affected: 8537257874e949a59c834cecfd5a063e11b64b0b , < 38c0abad45b190a30d8284a37264d2127a6ec303 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.13
Unaffected: 0 , < 5.13 (semver)
Unaffected: 5.15.194 , ≤ 5.15.* (semver)
Unaffected: 6.1.155 , ≤ 6.1.* (semver)
Unaffected: 6.6.109 , ≤ 6.6.* (semver)
Unaffected: 6.12.50 , ≤ 6.12.* (semver)
Unaffected: 6.16.10 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/usb/etas_es58x/es58x_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "72de0facc50afdb101fb7197d880407f1abfc77f",
              "status": "affected",
              "version": "8537257874e949a59c834cecfd5a063e11b64b0b",
              "versionType": "git"
            },
            {
              "lessThan": "c4e582e686c4d683c87f2b4a316385b3d81d370f",
              "status": "affected",
              "version": "8537257874e949a59c834cecfd5a063e11b64b0b",
              "versionType": "git"
            },
            {
              "lessThan": "cbc1de71766f326a44bb798aeae4a7ef4a081cc9",
              "status": "affected",
              "version": "8537257874e949a59c834cecfd5a063e11b64b0b",
              "versionType": "git"
            },
            {
              "lessThan": "b26cccd87dcddc47b450a40f3b1ac3fe346efcff",
              "status": "affected",
              "version": "8537257874e949a59c834cecfd5a063e11b64b0b",
              "versionType": "git"
            },
            {
              "lessThan": "e587af2c89ecc6382c518febea52fa9ba81e47c0",
              "status": "affected",
              "version": "8537257874e949a59c834cecfd5a063e11b64b0b",
              "versionType": "git"
            },
            {
              "lessThan": "38c0abad45b190a30d8284a37264d2127a6ec303",
              "status": "affected",
              "version": "8537257874e949a59c834cecfd5a063e11b64b0b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/usb/etas_es58x/es58x_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.194",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.155",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.194",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.155",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.109",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.50",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.10",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow\n\nSending an PF_PACKET allows to bypass the CAN framework logic and to\ndirectly reach the xmit() function of a CAN driver. The only check\nwhich is performed by the PF_PACKET framework is to make sure that\nskb-\u003elen fits the interface\u0027s MTU.\n\nUnfortunately, because the etas_es58x driver does not populate its\nnet_device_ops-\u003endo_change_mtu(), it is possible for an attacker to\nconfigure an invalid MTU by doing, for example:\n\n  $ ip link set can0 mtu 9999\n\nAfter doing so, the attacker could open a PF_PACKET socket using the\nETH_P_CANXL protocol:\n\n\tsocket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL));\n\nto inject a malicious CAN XL frames. For example:\n\n\tstruct canxl_frame frame = {\n\t\t.flags = 0xff,\n\t\t.len = 2048,\n\t};\n\nThe CAN drivers\u0027 xmit() function are calling can_dev_dropped_skb() to\ncheck that the skb is valid, unfortunately under above conditions, the\nmalicious packet is able to go through can_dev_dropped_skb() checks:\n\n  1. the skb-\u003eprotocol is set to ETH_P_CANXL which is valid (the\n     function does not check the actual device capabilities).\n\n  2. the length is a valid CAN XL length.\n\nAnd so, es58x_start_xmit() receives a CAN XL frame which it is not\nable to correctly handle and will thus misinterpret it as a CAN(FD)\nframe.\n\nThis can result in a buffer overflow. For example, using the es581.4\nvariant, the frame will be dispatched to es581_4_tx_can_msg(), go\nthrough the last check at the beginning of this function:\n\n\tif (can_is_canfd_skb(skb))\n\t\treturn -EMSGSIZE;\n\nand reach this line:\n\n\tmemcpy(tx_can_msg-\u003edata, cf-\u003edata, cf-\u003elen);\n\nHere, cf-\u003elen corresponds to the flags field of the CAN XL frame. In\nour previous example, we set canxl_frame-\u003eflags to 0xff. Because the\nmaximum expected length is 8, a buffer overflow of 247 bytes occurs!\n\nPopulate net_device_ops-\u003endo_change_mtu() to ensure that the\ninterface\u0027s MTU can not be set to anything bigger than CAN_MTU or\nCANFD_MTU (depending on the device capabilities). By fixing the root\ncause, this prevents the buffer overflow."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local syscalls on the host \u2014 creating a PF_PACKET/SOCK_RAW socket with ETH_P_CANXL and sendmsg() to the can interface (optionally preceded by an rtnetlink MTU change), with the frame reaching es58x_start_xmit() via dev_queue_xmit(). No remote or adjacent network peer can reach this path; the CAN bus itself is only the sink, not the source.\nAC:L - The overflow is fully deterministic: can_dropped_invalid_skb() accepts an ETH_P_CANXL skb on a non-XL device, es581_4_tx_can_msg()/es58x_fd_tx_can_msg() then reinterpret canxl_frame.flags as can_frame.len and memcpy() up to 255 attacker-chosen bytes into an 8-byte (or 64-byte) field. No race, no memory-layout guessing, and no condition outside the attacker\u0027s control is needed to trigger it.\nPR:L - The two gates are ns_capable(net-\u003euser_ns, CAP_NET_RAW) in packet_create() and ns_capable(CAP_NET_ADMIN) for the MTU change \u2014 both namespaced, and CAN netdevs are not netns-local, so a can0 delegated into a container/user namespace lets an otherwise unprivileged user hold both (CAP_NET_RAW is granted by default in typical container runtimes). No real root in the init namespace is required.\nUI:N - The attacker performs every step alone \u2014 bring the interface up, optionally set the MTU, open the packet socket and send the malicious CAN XL frame. No victim action or interaction is needed.\nS:U - The corruption stays within the kernel of the same host; there is no VM, IOMMU, or hypervisor boundary crossed. Impact and vulnerable component share one security authority.\nC:H - With a minimal skb (skb-\u003elen as low as 13\u201316 bytes, permitted even at the default CAN_MTU), memcpy() reads cf-\u003elen (up to 255) bytes from the small skb data area, over-reading adjacent kernel heap; that leaked memory is placed into the URB transfer buffer and DMA\u0027d out to the USB device, giving a readable kernel-memory disclosure primitive.\nI:H - Up to 247 bytes of attacker-controlled data are written past the intended message slot; for the ES581.4 the TX buffer is a ~509-byte usb_alloc_coherent() allocation served from the HCD\u0027s shared 512-byte dma_pool, so the overflow lands in adjacent in-use DMA buffers belonging to other USB transfers \u2014 a controlled out-of-bounds write suitable for further corruption.\nA:H - Corrupting neighbouring USB DMA-pool blocks and pool metadata reliably produces kernel oops/panic or wedged USB transfers, and the overflow can be re-triggered at will from an unprivileged socket, so the whole system\u0027s availability is at stake."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:06:55.862Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/72de0facc50afdb101fb7197d880407f1abfc77f"
        },
        {
          "url": "https://git.kernel.org/stable/c/c4e582e686c4d683c87f2b4a316385b3d81d370f"
        },
        {
          "url": "https://git.kernel.org/stable/c/cbc1de71766f326a44bb798aeae4a7ef4a081cc9"
        },
        {
          "url": "https://git.kernel.org/stable/c/b26cccd87dcddc47b450a40f3b1ac3fe346efcff"
        },
        {
          "url": "https://git.kernel.org/stable/c/e587af2c89ecc6382c518febea52fa9ba81e47c0"
        },
        {
          "url": "https://git.kernel.org/stable/c/38c0abad45b190a30d8284a37264d2127a6ec303"
        }
      ],
      "title": "can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39988",
    "datePublished": "2025-10-15T07:56:06.601Z",
    "dateReserved": "2025-04-16T07:20:57.150Z",
    "dateUpdated": "2026-08-05T12:06:55.862Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39988",
      "date": "2026-10-30",
      "epss": "0.00176",
      "percentile": "0.07172"
    },
    "microsoft_vex": {
      "current_release_date": "2025-10-16T01:01:43.000Z",
      "cve": "CVE-2025-39988",
      "id": "msrc_CVE-2025-39988",
      "initial_release_date": "2025-10-02T00:00:00.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-39988.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/can/usb/etas_es58x/es58x_core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "72de0facc50afdb101fb7197d880407f1abfc77f",
                    "status": "affected",
                    "version": "8537257874e949a59c834cecfd5a063e11b64b0b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c4e582e686c4d683c87f2b4a316385b3d81d370f",
                    "status": "affected",
                    "version": "8537257874e949a59c834cecfd5a063e11b64b0b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cbc1de71766f326a44bb798aeae4a7ef4a081cc9",
                    "status": "affected",
                    "version": "8537257874e949a59c834cecfd5a063e11b64b0b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b26cccd87dcddc47b450a40f3b1ac3fe346efcff",
                    "status": "affected",
                    "version": "8537257874e949a59c834cecfd5a063e11b64b0b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e587af2c89ecc6382c518febea52fa9ba81e47c0",
                    "status": "affected",
                    "version": "8537257874e949a59c834cecfd5a063e11b64b0b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "38c0abad45b190a30d8284a37264d2127a6ec303",
                    "status": "affected",
                    "version": "8537257874e949a59c834cecfd5a063e11b64b0b",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/can/usb/etas_es58x/es58x_core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.13"
                  },
                  {
                    "lessThan": "5.13",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.194",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.155",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.109",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.50",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.16.*",
                    "status": "unaffected",
                    "version": "6.16.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.17",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow\n\nSending an PF_PACKET allows to bypass the CAN framework logic and to\ndirectly reach the xmit() function of a CAN driver. The only check\nwhich is performed by the PF_PACKET framework is to make sure that\nskb-\u003elen fits the interface\u0027s MTU.\n\nUnfortunately, because the etas_es58x driver does not populate its\nnet_device_ops-\u003endo_change_mtu(), it is possible for an attacker to\nconfigure an invalid MTU by doing, for example:\n\n  $ ip link set can0 mtu 9999\n\nAfter doing so, the attacker could open a PF_PACKET socket using the\nETH_P_CANXL protocol:\n\n\tsocket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL));\n\nto inject a malicious CAN XL frames. For example:\n\n\tstruct canxl_frame frame = {\n\t\t.flags = 0xff,\n\t\t.len = 2048,\n\t};\n\nThe CAN drivers\u0027 xmit() function are calling can_dev_dropped_skb() to\ncheck that the skb is valid, unfortunately under above conditions, the\nmalicious packet is able to go through can_dev_dropped_skb() checks:\n\n  1. the skb-\u003eprotocol is set to ETH_P_CANXL which is valid (the\n     function does not check the actual device capabilities).\n\n  2. the length is a valid CAN XL length.\n\nAnd so, es58x_start_xmit() receives a CAN XL frame which it is not\nable to correctly handle and will thus misinterpret it as a CAN(FD)\nframe.\n\nThis can result in a buffer overflow. For example, using the es581.4\nvariant, the frame will be dispatched to es581_4_tx_can_msg(), go\nthrough the last check at the beginning of this function:\n\n\tif (can_is_canfd_skb(skb))\n\t\treturn -EMSGSIZE;\n\nand reach this line:\n\n\tmemcpy(tx_can_msg-\u003edata, cf-\u003edata, cf-\u003elen);\n\nHere, cf-\u003elen corresponds to the flags field of the CAN XL frame. In\nour previous example, we set canxl_frame-\u003eflags to 0xff. Because the\nmaximum expected length is 8, a buffer overflow of 247 bytes occurs!\n\nPopulate net_device_ops-\u003endo_change_mtu() to ensure that the\ninterface\u0027s MTU can not be set to anything bigger than CAN_MTU or\nCANFD_MTU (depending on the device capabilities). By fixing the root\ncause, this prevents the buffer overflow."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncan: etas_es58x: poblar ndo_change_mtu() para prevenir el desbordamiento de b\u00fafer\n\nEnviar un PF_PACKET permite eludir la l\u00f3gica del framework CAN y alcanzar directamente la funci\u00f3n xmit() de un controlador CAN. La \u00fanica comprobaci\u00f3n que realiza el framework PF_PACKET es asegurarse de que skb-\u003elen se ajusta a la MTU de la interfaz.\n\nDesafortunadamente, debido a que el controlador etas_es58x no puebla su net_device_ops-\u003endo_change_mtu(), es posible para un atacante configurar una MTU inv\u00e1lida haciendo, por ejemplo:\n\n  $ ip link set can0 mtu 9999\n\nDespu\u00e9s de hacerlo, el atacante podr\u00eda abrir un socket PF_PACKET usando el protocolo ETH_P_CANXL:\n\n\tsocket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL));\n\npara inyectar tramas CAN XL maliciosas. Por ejemplo:\n\n\tstruct canxl_frame frame = {\n\t\t.flags = 0xff,\n\t\t.len = 2048,\n\t};\n\nLa funci\u00f3n xmit() de los controladores CAN est\u00e1 llamando a can_dev_dropped_skb() para comprobar que el skb es v\u00e1lido, desafortunadamente bajo las condiciones anteriores, el paquete malicioso es capaz de pasar las comprobaciones de can_dev_dropped_skb():\n\n  1. el skb-\u003eprotocol est\u00e1 configurado como ETH_P_CANXL, lo cual es v\u00e1lido (la funci\u00f3n no comprueba las capacidades reales del dispositivo).\n\n  2. la longitud es una longitud CAN XL v\u00e1lida.\n\nY as\u00ed, es58x_start_xmit() recibe una trama CAN XL que no es capaz de manejar correctamente y, por lo tanto, la malinterpretar\u00e1 como una trama CAN(FD).\n\nEsto puede resultar en un desbordamiento de b\u00fafer. Por ejemplo, usando la variante es581.4, la trama ser\u00e1 despachada a es581_4_tx_can_msg(), pasando por la \u00faltima comprobaci\u00f3n al principio de esta funci\u00f3n:\n\n\tif (can_is_canfd_skb(skb))\n\t\treturn -EMSGSIZE;\n\ny alcanzar\u00e1 esta l\u00ednea:\n\n\tmemcpy(tx_can_msg-\u003edata, cf-\u003edata, cf-\u003elen);\n\nAqu\u00ed, cf-\u003elen corresponde al campo de banderas de la trama CAN XL. En nuestro ejemplo anterior, establecimos canxl_frame-\u003eflags en 0xff. Debido a que la longitud m\u00e1xima esperada es 8, \u00a1ocurre un desbordamiento de b\u00fafer de 247 bytes!\n\nPoblar net_device_ops-\u003endo_change_mtu() para asegurar que la MTU de la interfaz no pueda configurarse a nada mayor que CAN_MTU o CANFD_MTU (dependiendo de las capacidades del dispositivo). Al corregir la causa ra\u00edz, esto previene el desbordamiento de b\u00fafer."
          }
        ],
        "id": "CVE-2025-39988",
        "lastModified": "2026-10-19T21:10:00.160",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-10-15T08:15:36.913",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/38c0abad45b190a30d8284a37264d2127a6ec303"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/72de0facc50afdb101fb7197d880407f1abfc77f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b26cccd87dcddc47b450a40f3b1ac3fe346efcff"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c4e582e686c4d683c87f2b4a316385b3d81d370f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cbc1de71766f326a44bb798aeae4a7ef4a081cc9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e587af2c89ecc6382c518febea52fa9ba81e47c0"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-10-30T08:03:04+00:00",
      "cve": "CVE-2025-39988",
      "id": "CVE-2025-39988",
      "initial_release_date": "2025-10-15T00:00:00+00:00",
      "product_status:known_not_affected": "276",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39988.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.