CVE-2023-54105
Unknown Unknown - Not Provided
Improper Address Family Validation in Linux Kernel CAN_ISOTP Bind

Publication date: 2025-12-24

Last updated on: 2025-12-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: can: isotp: check CAN address family in isotp_bind() Add missing check to block non-AF_CAN binds. Syzbot created some code which matched the right sockaddr struct size but used AF_XDP (0x2C) instead of AF_CAN (0x1D) in the address family field: bind$xdp(r2, &(0x7f0000000540)={0x2c, 0x0, r4, 0x0, r2}, 0x10) ^^^^ This has no funtional impact but the userspace should be notified about the wrong address family field content.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-24
Last Modified
2025-12-24
Generated
2026-06-16
AI Q&A
2025-12-24
EPSS Evaluated
2026-06-14
NVD
CVE-2023-54105
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves the CAN (Controller Area Network) protocol's isotp_bind() function missing a check for the correct CAN address family (AF_CAN). Specifically, the code failed to block binds that used a non-AF_CAN address family, such as AF_XDP, which is incorrect. Although this does not have a functional impact, it means that userspace programs might be using the wrong address family field without being notified.

Impact Analysis

The vulnerability has no functional impact, meaning it does not affect the operation or security of the system. However, userspace applications might not be notified when they use an incorrect address family in CAN isotp_bind() calls, which could lead to confusion or improper usage of the API.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2023-54105. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart