CVE-2025-71182
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2026-01-31

Last updated on: 2026-03-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: can: j1939: make j1939_session_activate() fail if device is no longer registered syzbot is still reporting unregister_netdevice: waiting for vcan0 to become free. Usage count = 2 even after commit 93a27b5891b8 ("can: j1939: add missing calls in NETDEV_UNREGISTER notification handler") was added. A debug printk() patch found that j1939_session_activate() can succeed even after j1939_cancel_active_session() from j1939_netdev_notify(NETDEV_UNREGISTER) has completed. Since j1939_cancel_active_session() is processed with the session list lock held, checking ndev->reg_state in j1939_session_activate() with the session list lock held can reliably close the race window.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-31
Last Modified
2026-03-25
Generated
2026-06-16
AI Q&A
2026-02-01
EPSS Evaluated
2026-06-15
NVD
CVE-2025-71182
Affected Vendors & Products
Showing 15 associated CPEs
Vendor Product Version / Range
linux linux_kernel 5.4
linux linux_kernel From 5.11 (inc) to 5.15.198 (exc)
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel From 6.13 (inc) to 6.18.6 (exc)
linux linux_kernel From 6.2 (inc) to 6.6.121 (exc)
linux linux_kernel From 6.7 (inc) to 6.12.66 (exc)
linux linux_kernel From 5.16 (inc) to 6.1.161 (exc)
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel From 5.4.1 (inc) to 5.10.248 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Detection Guidance

Detection can involve monitoring for the message 'unregister_netdevice: waiting for vcan0 to become free. Usage count = 2' in kernel logs, which indicates the issue. Using dmesg or journalctl commands to check kernel messages can help identify this. For example, run 'dmesg | grep unregister_netdevice' or 'journalctl -k | grep unregister_netdevice' to find related messages.

Executive Summary

This vulnerability involves the Linux kernel's CAN J1939 protocol implementation. Specifically, the function j1939_session_activate() can succeed even after a session has been cancelled by j1939_cancel_active_session() during the NETDEV_UNREGISTER notification. This creates a race condition where the session activation does not properly check if the network device is still registered, potentially leading to improper handling of device unregistration and resource usage.

Impact Analysis

The vulnerability can cause the Linux kernel to wait indefinitely for a virtual CAN device (vcan0) to become free due to usage count not decrementing properly. This can lead to resource leaks or system instability related to network device unregistration, potentially affecting system reliability and performance.

Mitigation Strategies

Immediate mitigation involves ensuring the Linux kernel includes the fix from commit 93a27b5891b8, which adds missing calls in the NETDEV_UNREGISTER notification handler to prevent j1939_session_activate() from succeeding after j1939_cancel_active_session() has completed. Applying this patch or updating to a kernel version containing this fix is recommended.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-71182. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart