PT-2026-61307 · Linux · Linux Kernel
CVE-2026-63990
·
Published
2026-07-19
·
Updated
2026-07-19
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A kernel paging request crash occurs in the
can rx unregister() function within net/can/af can.c when a virtual CAN device (vxcan) is enslaved to a bonding master. This happens because the bonding driver modifies network device states to follow an Ethernet-like aggregation model, but CAN devices use a different Layer 2 architecture based on the can ml priv private data structure. Because bonding does not initialize these CAN structures, operations like closing sockets via isotp release result in a null-pointer dereference. This issue exists because virtual CAN devices bypass global loopback checks as they lack the IFF LOOPBACK flag. The flaw is triggered during the bond enslave() process when handling devices of type ARPHRD CAN.Recommendations
As a temporary workaround, avoid enslaving CAN devices to a bonding master. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux Kernel