CVE-2025-39985 (GCVE-0-2025-39985)

Vulnerability from cvelistv5 – Published: 2025-10-15 07:56 – Updated: 2026-08-05 12:06
VLAI
Title
can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
Summary
In the Linux kernel, the following vulnerability has been resolved: can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow Sending an PF_PACKET allows to bypass the CAN framework logic and to directly reach the xmit() function of a CAN driver. The only check which is performed by the PF_PACKET framework is to make sure that skb->len fits the interface's MTU. Unfortunately, because the mcba_usb driver does not populate its net_device_ops->ndo_change_mtu(), it is possible for an attacker to configure an invalid MTU by doing, for example: $ ip link set can0 mtu 9999 After doing so, the attacker could open a PF_PACKET socket using the ETH_P_CANXL protocol: socket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL)) to inject a malicious CAN XL frames. For example: struct canxl_frame frame = { .flags = 0xff, .len = 2048, }; The CAN drivers' xmit() function are calling can_dev_dropped_skb() to check that the skb is valid, unfortunately under above conditions, the malicious packet is able to go through can_dev_dropped_skb() checks: 1. the skb->protocol is set to ETH_P_CANXL which is valid (the function does not check the actual device capabilities). 2. the length is a valid CAN XL length. And so, mcba_usb_start_xmit() receives a CAN XL frame which it is not able to correctly handle and will thus misinterpret it as a CAN frame. This can result in a buffer overflow. The driver will consume cf->len as-is with no further checks on these lines: usb_msg.dlc = cf->len; memcpy(usb_msg.data, cf->data, usb_msg.dlc); Here, cf->len corresponds to the flags field of the CAN XL frame. In our previous example, we set canxl_frame->flags to 0xff. Because the maximum expected length is 8, a buffer overflow of 247 bytes occurs! Populate net_device_ops->ndo_change_mtu() to ensure that the interface's MTU can not be set to anything bigger than CAN_MTU. By fixing the root cause, this prevents the buffer overflow.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 51f3baad7de943780ce0c17bd7975df567dd6e14 , < 0fa9303c4b9493727e0d3a6ac3729300e3013930 (git)
Affected: 51f3baad7de943780ce0c17bd7975df567dd6e14 , < 37aed407496bf6de8910e588edb04d2435fa7011 (git)
Affected: 51f3baad7de943780ce0c17bd7975df567dd6e14 , < 6eec67bfb25637f9b51e584cf59ddace59925bc8 (git)
Affected: 51f3baad7de943780ce0c17bd7975df567dd6e14 , < ca4e51359608e1f29bf1f2c33c3ddf775b6b7ed1 (git)
Affected: 51f3baad7de943780ce0c17bd7975df567dd6e14 , < 3664ae91b26d1fd7e4cee9cde17301361f4c89d5 (git)
Affected: 51f3baad7de943780ce0c17bd7975df567dd6e14 , < 6b9fb82df8868dbe9ffea5874b8d35f951faedbb (git)
Affected: 51f3baad7de943780ce0c17bd7975df567dd6e14 , < b638c3fb0f163e69785ceddb3b434a9437878bec (git)
Affected: 51f3baad7de943780ce0c17bd7975df567dd6e14 , < 17c8d794527f01def0d1c8b7dc2d7b8d34fed0e6 (git)
Create a notification for this product.
Linux Linux Affected: 4.12
Unaffected: 0 , < 4.12 (semver)
Unaffected: 5.4.300 , ≤ 5.4.* (semver)
Unaffected: 5.10.245 , ≤ 5.10.* (semver)
Unaffected: 5.15.194 , ≤ 5.15.* (semver)
Unaffected: 6.1.155 , ≤ 6.1.* (semver)
Unaffected: 6.6.109 , ≤ 6.6.* (semver)
Unaffected: 6.12.50 , ≤ 6.12.* (semver)
Unaffected: 6.16.10 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/usb/mcba_usb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0fa9303c4b9493727e0d3a6ac3729300e3013930",
              "status": "affected",
              "version": "51f3baad7de943780ce0c17bd7975df567dd6e14",
              "versionType": "git"
            },
            {
              "lessThan": "37aed407496bf6de8910e588edb04d2435fa7011",
              "status": "affected",
              "version": "51f3baad7de943780ce0c17bd7975df567dd6e14",
              "versionType": "git"
            },
            {
              "lessThan": "6eec67bfb25637f9b51e584cf59ddace59925bc8",
              "status": "affected",
              "version": "51f3baad7de943780ce0c17bd7975df567dd6e14",
              "versionType": "git"
            },
            {
              "lessThan": "ca4e51359608e1f29bf1f2c33c3ddf775b6b7ed1",
              "status": "affected",
              "version": "51f3baad7de943780ce0c17bd7975df567dd6e14",
              "versionType": "git"
            },
            {
              "lessThan": "3664ae91b26d1fd7e4cee9cde17301361f4c89d5",
              "status": "affected",
              "version": "51f3baad7de943780ce0c17bd7975df567dd6e14",
              "versionType": "git"
            },
            {
              "lessThan": "6b9fb82df8868dbe9ffea5874b8d35f951faedbb",
              "status": "affected",
              "version": "51f3baad7de943780ce0c17bd7975df567dd6e14",
              "versionType": "git"
            },
            {
              "lessThan": "b638c3fb0f163e69785ceddb3b434a9437878bec",
              "status": "affected",
              "version": "51f3baad7de943780ce0c17bd7975df567dd6e14",
              "versionType": "git"
            },
            {
              "lessThan": "17c8d794527f01def0d1c8b7dc2d7b8d34fed0e6",
              "status": "affected",
              "version": "51f3baad7de943780ce0c17bd7975df567dd6e14",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/usb/mcba_usb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.300",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.245",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.194",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.155",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.300",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.245",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.194",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.155",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.109",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.50",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.10",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow\n\nSending an PF_PACKET allows to bypass the CAN framework logic and to\ndirectly reach the xmit() function of a CAN driver. The only check\nwhich is performed by the PF_PACKET framework is to make sure that\nskb-\u003elen fits the interface\u0027s MTU.\n\nUnfortunately, because the mcba_usb driver does not populate its\nnet_device_ops-\u003endo_change_mtu(), it is possible for an attacker to\nconfigure an invalid MTU by doing, for example:\n\n  $ ip link set can0 mtu 9999\n\nAfter doing so, the attacker could open a PF_PACKET socket using the\nETH_P_CANXL protocol:\n\n\tsocket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL))\n\nto inject a malicious CAN XL frames. For example:\n\n\tstruct canxl_frame frame = {\n\t\t.flags = 0xff,\n\t\t.len = 2048,\n\t};\n\nThe CAN drivers\u0027 xmit() function are calling can_dev_dropped_skb() to\ncheck that the skb is valid, unfortunately under above conditions, the\nmalicious packet is able to go through can_dev_dropped_skb() checks:\n\n  1. the skb-\u003eprotocol is set to ETH_P_CANXL which is valid (the\n     function does not check the actual device capabilities).\n\n  2. the length is a valid CAN XL length.\n\nAnd so, mcba_usb_start_xmit() receives a CAN XL frame which it is not\nable to correctly handle and will thus misinterpret it as a CAN frame.\n\nThis can result in a buffer overflow. The driver will consume cf-\u003elen\nas-is with no further checks on these lines:\n\n\tusb_msg.dlc = cf-\u003elen;\n\n\tmemcpy(usb_msg.data, cf-\u003edata, usb_msg.dlc);\n\nHere, cf-\u003elen corresponds to the flags field of the CAN XL frame. In\nour previous example, we set canxl_frame-\u003eflags to 0xff. Because the\nmaximum expected length is 8, a buffer overflow of 247 bytes occurs!\n\nPopulate net_device_ops-\u003endo_change_mtu() to ensure that the\ninterface\u0027s MTU can not be set to anything bigger than CAN_MTU. By\nfixing the root cause, this prevents the buffer overflow."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation is performed entirely with local syscalls on the host owning the CAN interface \u2014 `socket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL))` plus `sendmsg()`, optionally preceded by an rtnetlink MTU change. No remote or adjacent-network peer can reach `mcba_usb_start_xmit()`; the USB dongle and the CAN bus are only the sink for the resulting transfer, never the source of the malicious frame.\nAC:L - The overflow is fully deterministic \u2014 a single crafted CAN XL frame with `flags = 0xff` unconditionally makes `cf-\u003elen` 255 and drives a 255-byte `memcpy()` into an 8-byte stack field, with no race, no timing window, and no dependence on memory layout to trigger.\nPR:L - The minimal variant needs only `ns_capable(net-\u003euser_ns, CAP_NET_RAW)` from `packet_create()` because a 13\u201316 byte CAN XL skb already fits under the default `CAN_MTU`, and the fully-controlled-payload variant adds only the namespaced `CAP_NET_ADMIN` for the MTU change; CAN netdevs are not netns-local, so a `can0` delegated into a container or user namespace puts both capabilities in the hands of an unprivileged user, and typical container runtimes grant `CAP_NET_RAW` by default.\nUI:N - The attacker performs every step alone \u2014 open the packet socket, optionally set the MTU, and send the malicious CAN XL frame. No victim action, mount, or file open is involved.\nS:U - The corruption stays in kernel stack and adjacent heap memory within the same kernel security authority as the attacking process; no VM, hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - With a minimal 13-byte skb permitted at the default MTU, the `memcpy()` reads 255 bytes from a much smaller skb data area, over-reading ~247 bytes of adjacent kernel heap, and 8 of those bytes are copied into the URB and DMA\u0027d out to the USB device as an externally observable disclosure primitive; the stack corruption itself further yields arbitrary-read capability.\nI:H - Up to 247 bytes are written past an 8-byte array in a 19-byte stack struct, overwriting the stack canary, saved registers and return address of `mcba_usb_start_xmit()`, and with the MTU raised those bytes are entirely attacker-chosen \u2014 a classic control-flow hijack and arbitrary-write primitive suitable for privilege escalation.\nA:H - The stack smash trips the stack protector (`__stack_chk_fail` panic) or corrupts the transmitting task\u0027s frame in the xmit path, reliably producing a kernel oops or panic, and it can be re-triggered at will from an unprivileged socket."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:06:52.589Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0fa9303c4b9493727e0d3a6ac3729300e3013930"
        },
        {
          "url": "https://git.kernel.org/stable/c/37aed407496bf6de8910e588edb04d2435fa7011"
        },
        {
          "url": "https://git.kernel.org/stable/c/6eec67bfb25637f9b51e584cf59ddace59925bc8"
        },
        {
          "url": "https://git.kernel.org/stable/c/ca4e51359608e1f29bf1f2c33c3ddf775b6b7ed1"
        },
        {
          "url": "https://git.kernel.org/stable/c/3664ae91b26d1fd7e4cee9cde17301361f4c89d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b9fb82df8868dbe9ffea5874b8d35f951faedbb"
        },
        {
          "url": "https://git.kernel.org/stable/c/b638c3fb0f163e69785ceddb3b434a9437878bec"
        },
        {
          "url": "https://git.kernel.org/stable/c/17c8d794527f01def0d1c8b7dc2d7b8d34fed0e6"
        }
      ],
      "title": "can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39985",
    "datePublished": "2025-10-15T07:56:04.439Z",
    "dateReserved": "2025-04-16T07:20:57.150Z",
    "dateUpdated": "2026-08-05T12:06:52.589Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39985",
      "date": "2026-08-05",
      "epss": "0.00164",
      "percentile": "0.06067"
    },
    "microsoft_vex": {
      "current_release_date": "2025-10-16T01:01:37.000Z",
      "cve": "CVE-2025-39985",
      "id": "msrc_CVE-2025-39985",
      "initial_release_date": "2025-10-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-39985.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-39985\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-15T08:15:36.523\",\"lastModified\":\"2026-07-30T06:24:04.500\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncan: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow\\n\\nSending an PF_PACKET allows to bypass the CAN framework logic and to\\ndirectly reach the xmit() function of a CAN driver. The only check\\nwhich is performed by the PF_PACKET framework is to make sure that\\nskb-\u003elen fits the interface\u0027s MTU.\\n\\nUnfortunately, because the mcba_usb driver does not populate its\\nnet_device_ops-\u003endo_change_mtu(), it is possible for an attacker to\\nconfigure an invalid MTU by doing, for example:\\n\\n  $ ip link set can0 mtu 9999\\n\\nAfter doing so, the attacker could open a PF_PACKET socket using the\\nETH_P_CANXL protocol:\\n\\n\\tsocket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL))\\n\\nto inject a malicious CAN XL frames. For example:\\n\\n\\tstruct canxl_frame frame = {\\n\\t\\t.flags = 0xff,\\n\\t\\t.len = 2048,\\n\\t};\\n\\nThe CAN drivers\u0027 xmit() function are calling can_dev_dropped_skb() to\\ncheck that the skb is valid, unfortunately under above conditions, the\\nmalicious packet is able to go through can_dev_dropped_skb() checks:\\n\\n  1. the skb-\u003eprotocol is set to ETH_P_CANXL which is valid (the\\n     function does not check the actual device capabilities).\\n\\n  2. the length is a valid CAN XL length.\\n\\nAnd so, mcba_usb_start_xmit() receives a CAN XL frame which it is not\\nable to correctly handle and will thus misinterpret it as a CAN frame.\\n\\nThis can result in a buffer overflow. The driver will consume cf-\u003elen\\nas-is with no further checks on these lines:\\n\\n\\tusb_msg.dlc = cf-\u003elen;\\n\\n\\tmemcpy(usb_msg.data, cf-\u003edata, usb_msg.dlc);\\n\\nHere, cf-\u003elen corresponds to the flags field of the CAN XL frame. In\\nour previous example, we set canxl_frame-\u003eflags to 0xff. Because the\\nmaximum expected length is 8, a buffer overflow of 247 bytes occurs!\\n\\nPopulate net_device_ops-\u003endo_change_mtu() to ensure that the\\ninterface\u0027s MTU can not be set to anything bigger than CAN_MTU. By\\nfixing the root cause, this prevents the buffer overflow.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/can/usb/mcba_usb.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"51f3baad7de943780ce0c17bd7975df567dd6e14\",\"lessThan\":\"0fa9303c4b9493727e0d3a6ac3729300e3013930\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"51f3baad7de943780ce0c17bd7975df567dd6e14\",\"lessThan\":\"37aed407496bf6de8910e588edb04d2435fa7011\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"51f3baad7de943780ce0c17bd7975df567dd6e14\",\"lessThan\":\"6eec67bfb25637f9b51e584cf59ddace59925bc8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"51f3baad7de943780ce0c17bd7975df567dd6e14\",\"lessThan\":\"ca4e51359608e1f29bf1f2c33c3ddf775b6b7ed1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"51f3baad7de943780ce0c17bd7975df567dd6e14\",\"lessThan\":\"3664ae91b26d1fd7e4cee9cde17301361f4c89d5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"51f3baad7de943780ce0c17bd7975df567dd6e14\",\"lessThan\":\"6b9fb82df8868dbe9ffea5874b8d35f951faedbb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"51f3baad7de943780ce0c17bd7975df567dd6e14\",\"lessThan\":\"b638c3fb0f163e69785ceddb3b434a9437878bec\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"51f3baad7de943780ce0c17bd7975df567dd6e14\",\"lessThan\":\"17c8d794527f01def0d1c8b7dc2d7b8d34fed0e6\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/can/usb/mcba_usb.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.300\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.245\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.194\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.155\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.109\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.50\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16.10\",\"lessThanOrEqual\":\"6.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0fa9303c4b9493727e0d3a6ac3729300e3013930\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/17c8d794527f01def0d1c8b7dc2d7b8d34fed0e6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3664ae91b26d1fd7e4cee9cde17301361f4c89d5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/37aed407496bf6de8910e588edb04d2435fa7011\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6b9fb82df8868dbe9ffea5874b8d35f951faedbb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6eec67bfb25637f9b51e584cf59ddace59925bc8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b638c3fb0f163e69785ceddb3b434a9437878bec\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ca4e51359608e1f29bf1f2c33c3ddf775b6b7ed1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:17:30+00:00",
      "cve": "CVE-2025-39985",
      "id": "CVE-2025-39985",
      "initial_release_date": "2025-10-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39985.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.