CVE-2025-71182
BaseFortify
Publication date: 2026-01-31
Last updated on: 2026-03-25
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 5.4 |
| linux | linux_kernel | From 5.11 (inc) to 5.15.198 (exc) |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 6.13 (inc) to 6.18.6 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.121 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.66 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.161 (exc) |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 5.4.1 (inc) to 5.10.248 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can involve monitoring for the message 'unregister_netdevice: waiting for vcan0 to become free. Usage count = 2' in kernel logs, which indicates the issue. Using dmesg or journalctl commands to check kernel messages can help identify this. For example, run 'dmesg | grep unregister_netdevice' or 'journalctl -k | grep unregister_netdevice' to find related messages.
Can you explain this vulnerability to me?
This vulnerability involves the Linux kernel's CAN J1939 protocol implementation. Specifically, the function j1939_session_activate() can succeed even after a session has been cancelled by j1939_cancel_active_session() during the NETDEV_UNREGISTER notification. This creates a race condition where the session activation does not properly check if the network device is still registered, potentially leading to improper handling of device unregistration and resource usage.
How can this vulnerability impact me? :
The vulnerability can cause the Linux kernel to wait indefinitely for a virtual CAN device (vcan0) to become free due to usage count not decrementing properly. This can lead to resource leaks or system instability related to network device unregistration, potentially affecting system reliability and performance.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves ensuring the Linux kernel includes the fix from commit 93a27b5891b8, which adds missing calls in the NETDEV_UNREGISTER notification handler to prevent j1939_session_activate() from succeeding after j1939_cancel_active_session() has completed. Applying this patch or updating to a kernel version containing this fix is recommended.