NULL Pointer Dereference Vulnerability in Linux Kernel's CAN Driver
Summary
DEBIAN-CVE-2025-21773: In the Linux kernel, the following vulnerability has been resolved: can: etas_es58x: fix potential NULL pointer dereference on udev->serial The driver assumed that es58x_dev->udev->serial could never be NULL. Affects linux versions < 6.12.16-1. Fixed in 6.12.16-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interactions. It supports a wide range of devices and functionalities, including the Controller Area Network (CAN) subsystem, which facilitates communication between microcontrollers and devices. The specific vulnerability affects the CAN driver for es58x devices, which is designed to manage communication with these devices. This vulnerability arises from an assumption in the code that a USB serial number will always be present, which can be exploited by an attacker.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the CAN driver for es58x devices, where the code does not adequately check for a NULL pointer dereference on the udev->serial field. This oversight allows an attacker to spoof a device identity with a NULL USB serial number, leading to a potential crash of the kernel or other unintended behaviors. The vulnerability is significant as it could be exploited to disrupt system operations or gain unauthorized access to system resources.
How To Fix
Minimum fixed version
6.12.16-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, users are advised to monitor their systems for any unusual behavior and ensure that they are using the latest kernel version.
Conclusion
The identified NULL pointer dereference vulnerability in the Linux kernel's CAN driver for es58x devices poses a significant risk. Users are encouraged to update their systems to the patched version to mitigate potential threats. Regular monitoring and prompt updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a NULL pointer dereference in the CAN driver for es58x devices, which could be exploited by an attacker.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Exploitation of this vulnerability could lead to system crashes or unauthorized access to system resources.
Yes, a patch is available in the form of an updated Linux package version 6.12.16-1.
While there are no specific workarounds, it is advisable to monitor your system for unusual behavior until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
