SECUFOCUSNOW
Home›CVE index›CVE-2025-39988
Review reviewHigh

CVE-2025-39988

Linux

In the Linux kernel, the following vulnerability has been resolved: can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow Sending an PF_PACKET allows to bypass the CAN framework logic and to directly reach the xmit() function of a CAN driver. The only check which is performed by the PF_PACKET framework is to make sure that skb->len fits the interface's MTU. Unfortunately, because the etas_es58x driver does not populate its net_device_ops->ndo_change_mtu(), it is possible for an attacker to configure an invalid MTU by doing, for example: $ ip link set can0 mtu 9999 After doin...

CVSS
7.8
EPSS
-
- percentile
CISA KEV
Not listed
Published
2025.10.15
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow Sending an PF_PACKET allows to bypass the CAN framework logic and to directly reach the xmit() function of a CAN driver. The only check which is performed by the PF_PACKET framework is to make sure that skb->len fits the interface's MTU. Unfortunately, because the etas_es58x driver does not populate its net_device_ops->ndo_change_mtu(), it is possible for an attacker to configure an invalid MTU by doing, for example: $ ip link set can0 mtu 9999 After doin...

Affected product and versions

Product
Linux
Affected versions
>= 8537257874e949a59c834cecfd5a063e11b64b0b < 72de0facc50afdb101fb7197d880407f1abfc77f, >= 8537257874e949a59c834cecfd5a063e11b64b0b < c4e582e686c4d683c87f2b4a316385b3d81d370f, >= 8537257874e949a59c834cecfd5a063e11b64b0b < cbc1de71766f326a44bb798aeae4a7ef4a081cc9, >= 8537257874e949a59c834cecfd5a063e11b64b0b < b26cccd87dcddc47b450a40f3b1ac3fe346efcff, >= 8537257874e949a59c834cecfd5a063e11b64b0b < e587af2c89ecc6382c518febea52fa9ba81e47c0, >= 8537257874e949a59c834cecfd5a063e11b64b0b < 38c0abad45b190a30d8284a37264d2127a6ec303, >= 5.13
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
Not available