Listen to this Post
This vulnerability exists in the Linux kernel’s Controller Area Network (CAN) J1939 protocol implementation. The issue is a use-after-free flaw caused by improper reference counting during network device deregistration. When a socket is bound to a CAN J1939 network interface using j1939_sk_bind(), the function takes an extra reference on the `j1939_priv` structure. The kernel lacked a `NETDEV_UNREGISTER` notification handler to properly clean up this reference when the network device (like vcan0) was being unregistered. Consequently, the call to release this reference (j1939_priv_put()) was incorrectly delayed until the socket destructor (j1939_sk_sock_destruct()) was called. This prevented the associated `net_device` structure’s usage count from dropping to zero, leaving it stuck at a count of 2. The `unregister_netdevice()` function would then hang indefinitely, waiting for the device to become free, resulting in a denial-of-service (DoS) condition for the system.
Platform: Linux Kernel
Version: Affected versions unspecified
Vulnerability: Use-After-Free
Severity: Medium
Date: 2025-10-01
Prediction: 2025-10-23
What Undercode Say:
Check kernel version and if J1939 module is loaded uname -r lsmod | grep j1939 Check system logs for unregister_netdevice hang messages dmesg | grep -i "unregister_netdevice.waiting" journalctl --dmesg | grep -i vcan Verify if a vcan interface exists and its state ip link show type vcan
Analytics: The flaw is a local race condition triggered during interface shutdown. It requires a local, privileged user account to bind a J1939 socket before device removal. Successful exploitation causes a kernel hang, not arbitrary code execution.
How Exploit:
- Attacker with user privileges creates and binds a J1939 socket to a CAN interface (e.g.,
vcan0). - The attacker or another process triggers the unregistration of that network device.
- The kernel lacks the handler to release the binding reference.
4. `unregister_netdevice()` enters an infinite wait loop.
5. Result is a local denial-of-service (system hang).
Protection from this CVE
Apply kernel security updates.
Update to a kernel containing the fix.
The fix implements the missing `NETDEV_UNREGISTER` handler.
The handler releases the reference during unregister.
Restrict user access to CAN utilities.
Impact:
Local Denial-of-Service.
System resource exhaustion.
Kernel hang on shutdown.
No remote exploitation.
No data confidentiality impact.
Integrity impact is none.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
