CVE-2025-71182
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2026-01-31

Last updated on: 2026-03-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: can: j1939: make j1939_session_activate() fail if device is no longer registered syzbot is still reporting unregister_netdevice: waiting for vcan0 to become free. Usage count = 2 even after commit 93a27b5891b8 ("can: j1939: add missing calls in NETDEV_UNREGISTER notification handler") was added. A debug printk() patch found that j1939_session_activate() can succeed even after j1939_cancel_active_session() from j1939_netdev_notify(NETDEV_UNREGISTER) has completed. Since j1939_cancel_active_session() is processed with the session list lock held, checking ndev->reg_state in j1939_session_activate() with the session list lock held can reliably close the race window.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-31
Last Modified
2026-03-25
Generated
2026-05-07
AI Q&A
2026-02-01
EPSS Evaluated
2026-05-05
NVD
Affected Vendors & Products
Showing 15 associated CPEs
Vendor Product Version / Range
linux linux_kernel 5.4
linux linux_kernel From 5.11 (inc) to 5.15.198 (exc)
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel From 6.13 (inc) to 6.18.6 (exc)
linux linux_kernel From 6.2 (inc) to 6.6.121 (exc)
linux linux_kernel From 6.7 (inc) to 6.12.66 (exc)
linux linux_kernel From 5.16 (inc) to 6.1.161 (exc)
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel From 5.4.1 (inc) to 5.10.248 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?

Detection can involve monitoring for the message 'unregister_netdevice: waiting for vcan0 to become free. Usage count = 2' in kernel logs, which indicates the issue. Using dmesg or journalctl commands to check kernel messages can help identify this. For example, run 'dmesg | grep unregister_netdevice' or 'journalctl -k | grep unregister_netdevice' to find related messages.


Can you explain this vulnerability to me?

This vulnerability involves the Linux kernel's CAN J1939 protocol implementation. Specifically, the function j1939_session_activate() can succeed even after a session has been cancelled by j1939_cancel_active_session() during the NETDEV_UNREGISTER notification. This creates a race condition where the session activation does not properly check if the network device is still registered, potentially leading to improper handling of device unregistration and resource usage.


How can this vulnerability impact me? :

The vulnerability can cause the Linux kernel to wait indefinitely for a virtual CAN device (vcan0) to become free due to usage count not decrementing properly. This can lead to resource leaks or system instability related to network device unregistration, potentially affecting system reliability and performance.


What immediate steps should I take to mitigate this vulnerability?

Immediate mitigation involves ensuring the Linux kernel includes the fix from commit 93a27b5891b8, which adds missing calls in the NETDEV_UNREGISTER notification handler to prevent j1939_session_activate() from succeeding after j1939_cancel_active_session() has completed. Applying this patch or updating to a kernel version containing this fix is recommended.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart