CVE-2025-38224

In the Linux kernel, the following vulnerability has been resolved: can: kvaser_pciefd: refine error prone echo_skb_max handling logic echo_skb_max should define the supported upper limit of echo_skb[] allocated inside the netdevice's priv. The corresponding size value provided by this driver to alloc_candev() is KVASER_PCIEFD_CAN_TX_MAX_COUNT which is 17. But later echo_skb_max is rounded up to the nearest power of two (for the max case, that would be 32) and the tx/ack indices calculated further during tx/rx may exceed the upper array boundary. Kasan reported this for the ack case inside kvaser_pciefd_handle_ack_packet(), though the xmit function has actually caught the same thing earlier. BUG: KASAN: slab-out-of-bounds in kvaser_pciefd_handle_ack_packet+0x2d7/0x92a drivers/net/can/kvaser_pciefd.c:1528 Read of size 8 at addr ffff888105e4f078 by task swapper/4/0 CPU: 4 UID: 0 PID: 0 Comm: swapper/4 Not tainted 6.15.0 #12 PREEMPT(voluntary) Call Trace: <IRQ> dump_stack_lvl lib/dump_stack.c:122 print_report mm/kasan/report.c:521 kasan_report mm/kasan/report.c:634 kvaser_pciefd_handle_ack_packet drivers/net/can/kvaser_pciefd.c:1528 kvaser_pciefd_read_packet drivers/net/can/kvaser_pciefd.c:1605 kvaser_pciefd_read_buffer drivers/net/can/kvaser_pciefd.c:1656 kvaser_pciefd_receive_irq drivers/net/can/kvaser_pciefd.c:1684 kvaser_pciefd_irq_handler drivers/net/can/kvaser_pciefd.c:1733 __handle_irq_event_percpu kernel/irq/handle.c:158 handle_irq_event kernel/irq/handle.c:210 handle_edge_irq kernel/irq/chip.c:833 __common_interrupt arch/x86/kernel/irq.c:296 common_interrupt arch/x86/kernel/irq.c:286 </IRQ> Tx max count definitely matters for kvaser_pciefd_tx_avail(), but for seq numbers' generation that's not the case - we're free to calculate them as would be more convenient, not taking tx max count into account. The only downside is that the size of echo_skb[] should correspond to the max seq number (not tx max count), so in some situations a bit more memory would be consumed than could be. Thus make the size of the underlying echo_skb[] sufficient for the rounded max tx value. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

• CWE-125

• https://git.kernel.org/stable/c/54ec8b08216f3be2cc98b33633d3c8ea79749895Patch
• https://git.kernel.org/stable/c/a6550c9aa11e2f57f9cdaa6249cdd44d446be874Patch
• https://git.kernel.org/stable/c/d8a054b6e6824a8b52c3977ebd38c9583a63efacPatch

Published

Jul 4, 2025

Last Modified

Jul 30, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-38219In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-3822A vulnerability was found in SourceCodester Web-based Pharma…5.4
• CVE-2025-38220In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-38221In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2025-38222In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-38223In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-38225In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-38226In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2025-38227In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2025-38228In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-38229In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-3823A vulnerability classified as problematic has been found in …4.1