CVE-2025-71182

In the Linux kernel, the following vulnerability has been resolved: can: j1939: make j1939_session_activate() fail if device is no longer registered syzbot is still reporting unregister_netdevice: waiting for vcan0 to become free. Usage count = 2 even after commit 93a27b5891b8 ("can: j1939: add missing calls in NETDEV_UNREGISTER notification handler") was added. A debug printk() patch found that j1939_session_activate() can succeed even after j1939_cancel_active_session() from j1939_netdev_notify(NETDEV_UNREGISTER) has completed. Since j1939_cancel_active_session() is processed with the session list lock held, checking ndev->reg_state in j1939_session_activate() with the session list lock held can reliably close the race window.

• linux linux kernel (>= 5.4.1 < 5.10.248) • linux linux kernel (>= 5.11 < 5.15.198) • linux linux kernel (>= 5.16 < 6.1.161) • linux linux kernel (>= 6.2 < 6.6.121) • linux linux kernel (>= 6.7 < 6.12.66) • linux linux kernel (>= 6.13 < 6.18.6) • linux linux kernel 5.4 • linux linux kernel 6.19