Critical NULL Pointer Dereference in Linux Kernel - Affects Debian Linux Packages
Summary
CVE-2025-38665: In the Linux kernel, the following vulnerability has been resolved: can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode Andrei Lalaev reported a NULL pointer deref when a CAN device is... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware resources and providing essential services to applications. It is known for its stability, performance, and security features. However, vulnerabilities can arise, impacting the kernel's functionality and the overall security of systems running Debian. This specific vulnerability affects various versions of the Linux package across Debian distributions 11, 12, 13, and 14.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the CAN (Controller Area Network) subsystem, specifically in the function can_changelink(). This issue arises when a CAN device is restarted from a Bus Off state, and the driver does not implement the struct can_priv::do_set_mode callback. This can lead to a NULL pointer dereference, causing potential system crashes or instability. The vulnerability was reported by Andrei Lalaev and affects multiple Debian versions, with the risk of exploitation if the affected code paths are triggered.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid manual restarts of CAN devices or configure the automatic restart delay in can_changelink() to prevent triggering the NULL pointer dereference. Additionally, ensure that the struct can_priv::do_set_mode callback is implemented correctly in the driver to avoid this issue.
Conclusion
The identified vulnerability in the Linux kernel poses a significant risk to systems running Debian. It is crucial for users to update their packages to the patched versions to mitigate potential risks. Implementing workarounds can provide temporary relief, but updating is the best course of action.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a NULL pointer dereference in the Linux kernel's CAN subsystem, which can lead to system crashes.
Debian versions 11, 12, 13, and 14 are affected, with specific patched versions available for 13 and 14.
You can use Vulert, a tool that monitors open-source vulnerabilities in your software. Simply upload your manifest file, like package-lock.json, to check for vulnerabilities.
As a temporary measure, avoid manual restarts of CAN devices and ensure that the struct can_priv::do_set_mode callback is implemented in your driver.
Detailed information can be found in the CVE report for CVE-2025-38665, which outlines the vulnerability and its implications.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
