Critical NULL Pointer Dereference in Linux Kernel's CAN Module - CVE-2025-21775
Summary
CVE-2025-21775: In the Linux kernel, the following vulnerability has been resolved: can: ctucanfd: handle skb allocation failure If skb allocation fails, the pointer to struct can_frame is NULL. Affects linux versions < 6.1.129-1. Fixed in 6.1.129-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a widely used open-source operating system kernel that serves as the foundation for various distributions, including Debian. It manages hardware resources and provides essential services for software applications. The kernel's CAN (Controller Area Network) module facilitates communication between microcontrollers and devices in automotive and industrial applications. This vulnerability affects the CAN module, specifically in the ctucanfd driver, which is responsible for handling CAN frames.
Vulnerability Detail
CVE-2025-21775 is a vulnerability in the Linux kernel's CAN module where a failure in socket buffer (skb) allocation can lead to a NULL pointer dereference. This issue arises because the code does not adequately check for NULL pointers after an allocation failure. If this vulnerability is exploited, it could lead to system crashes or unexpected behavior, potentially impacting the stability and reliability of systems relying on the CAN module.
How To Fix
Minimum fixed version
6.1.129-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability. It is recommended to apply the patch as soon as it becomes available to mitigate the risk.
Conclusion
CVE-2025-21775 is a significant vulnerability in the Linux kernel's CAN module that requires immediate attention. Users are advised to update their systems to the latest kernel version to mitigate the risks associated with this vulnerability. Regular monitoring and updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
CVE-2025-21775 is a vulnerability in the Linux kernel's CAN module that can lead to a NULL pointer dereference due to skb allocation failure.
Exploitation of this vulnerability can cause system crashes or unexpected behavior, particularly in systems that rely on the CAN module for communication.
Yes, users should update their Linux kernel to the latest version provided by their distribution to ensure the vulnerability is patched.
While there are no specific workarounds, it is crucial to monitor for updates and apply them as soon as possible to mitigate risks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground at Vulert Scanner without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
