UBUNTU-CVE-2025-39986

In the Linux kernel, the following vulnerability has been resolved: can: sun4ican: populate ndochangemtu to prevent buffer overflow Sending an PFPACKET allows to bypass the CAN framework logic and to directly reach the xmit function of a CAN driver. The only check which is performed by the PFPACK...

CVE-2025-39987 can: hi311x: populate ndo_change_mtu() to prevent buffer overflow

In the Linux kernel, the following vulnerability has been resolved: can: hi311x: populate ndochangemtu to prevent buffer overflow Sending an PFPACKET allows to bypass the CAN framework logic and to directly reach the xmit function of a CAN driver. The only check which is performed by the PFPACKET...

CVE-2025-39985

In CVE-2025-39985, the Linux kernel mcba_usb driver fails to populate net_device_ops->ndo_change_mtu(), allowing an attacker using PF_PACKET (ETH_P_CANXL) to set an invalid MTU (e.g., can0 mtu 9999). The PF_PACKET framework only verifies skb->len against the interface MTU, so a crafted CAN ...