CVE-2023-54152: can: j1939: prevent deadlock by moving j1939_sk_errqueue()
In the Linux kernel, the following vulnerability has been resolved:
can: j1939: prevent deadlock by moving j1939_sk_errqueue()
This commit addresses a deadlock situation that can occur in certain
scenarios, such as when running data TP/ETP transfer and subscribing to
the error queue while receiving a net down event. The deadlock involves
locks in the following order:
3
j1939_session_list_lock -> active_session_list_lock
j1939_session_activate
...
j1939_sk_queue_activate_next -> sk_session_queue_lock
...
j1939_xtp_rx_eoma_one
2
j1939_sk_queue_drop_all -> sk_session_queue_lock
...
j1939_sk_netdev_event_netdown -> j1939_socks_lock
j1939_netdev_notify
1
j1939_sk_errqueue -> j1939_socks_lock
__j1939_session_cancel -> active_session_list_lock
j1939_tp_rxtimer
CPU0 CPU1
---- ----
lock(&priv->active_session_list_lock);
lock(&jsk->sk_session_queue_lock);
lock(&priv->active_session_list_lock);
lock(&priv->j1939_socks_lock);
The solution implemented in this commit is to move the
j1939_sk_errqueue() call out of the active_session_list_lock context,
thus preventing the deadlock situation.
Security readout for executives and security teams
Plain-English summary
This Linux kernel flaw can deadlock the CAN J1939 networking code during specific error-queue and network-down timing. The likely business impact is availability loss on systems that rely on J1939, such as vehicle, industrial, or embedded CAN environments. Public sources do not show active exploitation.
Executive priority
Treat as a targeted availability risk, not a broad enterprise emergency. Patch in normal kernel maintenance cycles, but accelerate for systems where CAN J1939 availability affects safety, operations, or revenue.
Technical view
The issue is a lock-order deadlock in the Linux CAN J1939 stack involving active_session_list_lock, sk_session_queue_lock, and j1939_socks_lock. The kernel fix moves j1939_sk_errqueue() outside the active_session_list_lock context to prevent the deadlock during TP/ETP transfer and netdev down handling.
Likely exposure
Exposure appears limited to Linux systems using the CAN J1939 subsystem, especially where TP/ETP transfer, error queue subscription, and interface-down events can coincide.
Exploitation context
The source bundle reports no KEV listing and provides no evidence of public exploitation. The condition appears timing-dependent and tied to CAN J1939 operational paths, not a general remote internet exposure.
Researcher notes
Evidence is limited to the CVE record and kernel stable commit references. No CVSS, CWE, exploit details, or distribution-specific package status is provided in the bundle, so exposure assessment depends on local kernel builds and backports.
Mitigation direction
Apply a vendor kernel update containing the referenced stable fixes.
Prioritize embedded, automotive, industrial, and test systems using CAN J1939.
Check Linux distribution advisories for backported fixes before assuming version safety.
Reduce reliance on affected J1939 paths until patched where operationally feasible.
Validation and detection
Inventory Linux kernel versions on systems with CAN or J1939 support.
Confirm whether CAN J1939 is enabled and used in production workloads.
Verify the installed kernel includes the referenced stable commits or vendor backports.
Review operational logs for hangs around J1939 TP/ETP transfers and netdev-down events.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2023-54152 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
0CVSS vectors
3Timeline events
0ADP providers
5Source links
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
CVE publishedCVE Program
The CVE record was published.
Dec 24, 2025, 13:07 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.