Executive brief
A vulnerability exists in the Linux kernel's driver for the Microchip CAN BUS Analyzer (mcba_usb). The driver fails to properly restrict the maximum size of data packets (MTU), allowing a local user to configure an oversized limit. By sending specially crafted network traffic, an attacker could trigger a buffer overflow, potentially leading to a system crash or unauthorized access to sensitive information.
Technical details
The mcba_usb driver in the Linux kernel does not populate the 'ndo_change_mtu' function in its 'net_device_ops' structure. This omission allows a local attacker with sufficient privileges to set an arbitrarily large MTU (e.g., 9999) on the CAN interface. By subsequently opening a PF_PACKET socket using the ETH_P_CANXL protocol, an attacker can inject malicious CAN XL frames that bypass standard CAN framework checks. When the driver's 'mcba_usb_start_xmit' function processes these frames, it misinterprets CAN XL metadata as a length field, leading to a memcpy-based buffer overflow of up to 247 bytes. The fix involves populating 'ndo_change_mtu' with 'can_change_mtu' to enforce proper MTU limits.
Affected products
- Linux Linux Kernel 4.12 to 6.11.x
Timeline
- 2025-09-18: disclosed: Initial patch submission by Vincent Mailhol
- 2025-10-02: patched: Patch committed to stable branches
- 2025-10-15: advisory: CVE-2025-39985 published
References
- https://git.kernel.org/stable/c/0fa9303c4b9493727e0d3a6ac3729300e3013930
- https://git.kernel.org/stable/c/17c8d794527f01def0d1c8b7dc2d7b8d34fed0e6
- https://git.kernel.org/stable/c/3664ae91b26d1fd7e4cee9cde17301361f4c89d5
- https://git.kernel.org/stable/c/37aed407496bf6de8910e588edb04d2435fa7011
- https://git.kernel.org/stable/c/6b9fb82df8868dbe9ffea5874b8d35f951faedbb
- https://git.kernel.org/stable/c/6eec67bfb25637f9b51e584cf59ddace59925bc8
- https://git.kernel.org/stable/c/b638c3fb0f163e69785ceddb3b434a9437878bec