CVE-2025-71182

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2026-01-31

Last updated on: 2026-03-25

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: can: j1939: make j1939_session_activate() fail if device is no longer registered syzbot is still reporting unregister_netdevice: waiting for vcan0 to become free. Usage count = 2 even after commit 93a27b5891b8 ("can: j1939: add missing calls in NETDEV_UNREGISTER notification handler") was added. A debug printk() patch found that j1939_session_activate() can succeed even after j1939_cancel_active_session() from j1939_netdev_notify(NETDEV_UNREGISTER) has completed. Since j1939_cancel_active_session() is processed with the session list lock held, checking ndev->reg_state in j1939_session_activate() with the session list lock held can reliably close the race window.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-31

Last Modified

2026-03-25

Generated

2026-07-06

AI Q&A

2026-01-31

EPSS Evaluated

2026-07-05

NVD

CVE-2025-71182

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	5.4
linux	linux_kernel	From 5.11 (inc) to 5.15.198 (exc)
linux	linux_kernel	6.19
linux	linux_kernel	6.19
linux	linux_kernel	6.19
linux	linux_kernel	6.19
linux	linux_kernel	6.19
linux	linux_kernel	From 6.13 (inc) to 6.18.6 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.121 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.66 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.161 (exc)
linux	linux_kernel	6.19
linux	linux_kernel	6.19
linux	linux_kernel	6.19
linux	linux_kernel	From 5.4.1 (inc) to 5.10.248 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability involves the Linux kernel's CAN J1939 protocol implementation. Specifically, the function j1939_session_activate() can succeed even after a session has been cancelled by j1939_cancel_active_session() during the NETDEV_UNREGISTER notification. This creates a race condition where the session activation does not properly check if the network device is still registered, potentially leading to improper handling of device unregistration and resource usage.

Detection Guidance

Detection can involve monitoring for the message 'unregister_netdevice: waiting for vcan0 to become free. Usage count = 2' in kernel logs, which indicates the issue. Using dmesg or journalctl commands to check kernel messages can help identify this. For example, run 'dmesg | grep unregister_netdevice' or 'journalctl -k | grep unregister_netdevice' to find related messages.

Mitigation Strategies

Immediate mitigation involves ensuring the Linux kernel includes the fix from commit 93a27b5891b8, which adds missing calls in the NETDEV_UNREGISTER notification handler to prevent j1939_session_activate() from succeeding after j1939_cancel_active_session() has completed. Applying this patch or updating to a kernel version containing this fix is recommended.

Impact Analysis

The vulnerability can cause the Linux kernel to wait indefinitely for a virtual CAN device (vcan0) to become free due to usage count not decrementing properly. This can lead to resource leaks or system instability related to network device unregistration, potentially affecting system reliability and performance.

Hi! I’m here to help you understand CVE-2025-71182. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70