CVE-2025-39985: Linux 4.12

Affected technology

Linux · 51f3baad7de943780ce0c17bd7975df567dd6e14 to before 0fa9303c4b9493727e0d3a6ac3729300e3013930, 51f3baad7de943780ce0c17bd7975df567dd6e14 to before 37aed407496bf6de8910e588edb04d2435fa7011, 51f3baad7de943780ce0c17bd7975df567dd6e14 to before 6eec67bfb25637f9b51e584cf59ddace59925bc8, 51f3baad7de943780ce0c17bd7975df567dd6e14 to before ca4e51359608e1f29bf1f2c33c3ddf775b6b7ed1, 51f3baad7de943780ce0c17bd7975df567dd6e14 to before 3664ae91b26d1fd7e4cee9cde17301361f4c89d5, 51f3baad7de943780ce0c17bd7975df567dd6e14 to before 6b9fb82df8868dbe9ffea5874b8d35f951faedbb, 51f3baad7de943780ce0c17bd7975df567dd6e14 to before b638c3fb0f163e69785ceddb3b434a9437878bec, 51f3baad7de943780ce0c17bd7975df567dd6e14 to before 17c8d794527f01def0d1c8b7dc2d7b8d34fed0e6
Linux

Linux · 4.12
Linux

Component: Not specified by the source
Function: of
File: drivers/net/can/usb/mcba_usb.c

Attack conditions (Source advisory, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

The source says unfortunately, because the mcba_usb driver does not populate its net_device_ops->ndo_change_mtu(), it is possible for an attacker to configure an invalid MTU by doing, for example: $ ip link set can0 mtu 9999 After doing so, the attacker could open a PF_PACKET socket using the ETH_P_CANXL protocol: socket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL)) to inject a malicious CAN XL frames. Source advisory’s CVSS 3.1 assessment (base score 7.8/10) rates confidentiality, integrity and availability impact as high.