Executive brief
The Linux kernel's Controller Area Network (CAN) j1939 protocol implementation has a resource management bug that prevents network devices from being properly unregistered. When a network interface using j1939 is removed, the protocol fails to release internal references correctly, causing the system to hang waiting for the device to become free. This can lead to denial of service and system instability.
Technical details
The vulnerability is a resource leak in the j1939 CAN protocol handler (net/can/j1939/). The root cause is that the NETDEV_UNREGISTER notification handler was missing, preventing cleanup of socket bindings when a network device is being unregistered. When j1939_sk_bind() binds a socket, it holds a reference to the j1939_priv structure. However, without a NETDEV_UNREGISTER handler, this reference is never released during device unregistration, only during socket destruction via j1939_sk_release(). This prevents unregister_netdevice() from completing because the usage count never reaches 1. The fix implements a new j1939_sk_netdev_event_unregister() handler that properly releases these references when the device is unregistered. This is a local denial-of-service condition triggered when unregistering network interfaces; no network access or privilege escalation is involved.
Affected products
- Linux Linux Kernel All versions with j1939 support (introduced in Linux 5.4)
Timeline
- 2025-10-01: disclosed: CVE-2025-39925 published on NVD
- 2025-08-25: patched: Fix committed upstream (commit 7fcbe5b2c6a4b5407bf2241fdb71e0a390f6ab9a) by Tetsuo Handa