CVE-2026-63990

In CVE-2026-63990, the Linux kernel bonding code incorrectly allowed enslaving CAN devices (including vxcan) to a bonding master, which mutated CAN private state (can_ml_priv) rather than Ethernet-like structures. This caused a kernel paging request crash in can_rx_unregister() and potential memo...