Junglewise Threat Intelligence

CVE-2025-39986: Linux Kernel sun4i_can buffer overflow via invalid MTU

CVE-2025-39986 · Severity: high · CVSS 7.8 · Published 2025-10-15

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's CAN (Controller Area Network) driver for Allwinner A10/A20 processors could allow a local attacker to crash the system or potentially execute unauthorized code. The issue occurs because the driver fails to properly validate the size of data packets, allowing an attacker to trigger a memory buffer overflow. This could lead to a complete system failure or a breach of data integrity on affected industrial or automotive embedded systems.

Technical details

A buffer overflow exists in the sun4i_can driver (drivers/net/can/sun4i_can.c) because it fails to populate the ndo_change_mtu function in net_device_ops. This omission allows a local user with sufficient privileges to set an arbitrarily large MTU (e.g., 9999) on the CAN interface. By opening a PF_PACKET socket using the ETH_P_CANXL protocol, an attacker can bypass the standard CAN framework validation and send malicious CAN XL frames to the driver's xmit function. The driver incorrectly interprets the CAN XL 'flags' field as a standard CAN 'length' (dlc) field; if the flags are set to a high value (e.g., 0xff), the subsequent write loop overflows the hardware register buffer by up to 247 bytes. The vulnerability is resolved by properly populating ndo_change_mtu to enforce the CAN_MTU limit.

Affected products

  • Linux Linux Kernel 4.4 to 6.15

Timeline

  • 2025-09-18: disclosed: Initial patch submitted by Vincent Mailhol
  • 2025-10-02: patched: Patch committed to stable trees
  • 2025-10-15: advisory: CVE-2025-39986 published

References

Related threats