CVE-2025-39925
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-39925
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-39925.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-39925
- Downstream
- Related
- Published
- 2025-10-01T08:07:13Z
- Modified
- 2025-10-22T16:34:02.372961Z
- Summary
- can: j1939: implement NETDEV_UNREGISTER notification handler
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
can: j1939: implement NETDEV_UNREGISTER notification handler
syzbot is reporting
unregister_netdevice: waiting for vcan0 to become free. Usage count = 2
problem, for j1939 protocol did not have NETDEVUNREGISTER notification handler for undoing changes made by j1939sk_bind().
Commit 25fe97cb7620 ("can: j1939: move j1939privput() into skdestruct callback") expects that a call to j1939privput() can be unconditionally delayed until j1939sksockdestruct() is called. But we need to call j1939privput() against an extra ref held by j1939skbind() call (as a part of undoing changes made by j1939skbind()) as soon as NETDEVUNREGISTER notification fires (i.e. before j1939sksockdestruct() is called via j1939skrelease()). Otherwise, the extra ref on "struct j1939priv" held by j1939skbind() call prevents "struct netdevice" from dropping the usage count to 1; making it impossible for unregister_netdevice() to continue.
[mkl: remove space in front of label]
- References
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced9d71dd0c70099914fcd063135da3c580865e924cFixedda9e8f429139928570407e8f90559b5d46c20262
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced9d71dd0c70099914fcd063135da3c580865e924cFixed7fcbe5b2c6a4b5407bf2241fdb71e0a390f6ab9a