LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38224: can: kvaser_pciefd: refine error prone echo_skb_max handling logic

In the Linux kernel, the following vulnerability has been resolved: can: kvaser_pciefd: refine error prone echo_skb_max handling logic echo_skb_max should define the supported upper limit of echo_skb[] allocated inside the netdevice's priv. The corresponding size value provided by this driver to alloc_candev() is KVASER_PCIEFD_CAN_TX_MAX_COUNT which is 17. But later echo_skb_max is rounded up to the nearest power of two (for the max case, that would be 32) and the tx/ack indices calculated further during tx/rx may exceed the upper array boundary. Kasan reported this for the ack case inside kvaser_pciefd_handle_ack_packet(), though the xmit function has actually caught the same thing earlier. BUG: KASAN: slab-out-of-bounds in kvaser_pciefd_handle_ack_packet+0x2d7/0x92a drivers/net/can/kvaser_pciefd.c:1528 Read of size 8 at addr ffff888105e4f078 by task swapper/4/0 CPU: 4 UID: 0 PID: 0 Comm: swapper/4 Not tainted 6.15.0 #12 PREEMPT(voluntary) Call Trace: <IRQ> dump_stack_lvl lib/dump_stack.c:122 print_report mm/kasan/report.c:521 kasan_report mm/kasan/report.c:634 kvaser_pciefd_handle_ack_packet drivers/net/can/kvaser_pciefd.c:1528 kvaser_pciefd_read_packet drivers/net/can/kvaser_pciefd.c:1605 kvaser_pciefd_read_buffer drivers/net/can/kvaser_pciefd.c:1656 kvaser_pciefd_receive_irq drivers/net/can/kvaser_pciefd.c:1684 kvaser_pciefd_irq_handler drivers/net/can/kvaser_pciefd.c:1733 __handle_irq_event_percpu kernel/irq/handle.c:158 handle_irq_event kernel/irq/handle.c:210 handle_edge_irq kernel/irq/chip.c:833 __common_interrupt arch/x86/kernel/irq.c:296 common_interrupt arch/x86/kernel/irq.c:286 </IRQ> Tx max count definitely matters for kvaser_pciefd_tx_avail(), but for seq numbers' generation that's not the case - we're free to calculate them as would be more convenient, not taking tx max count into account. The only downside is that the size of echo_skb[] should correspond to the max seq number (not tx max count), so in some situations a bit more memory would be consumed than could be. Thus make the size of the underlying echo_skb[] sufficient for the rounded max tx value. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux CAN driver can access memory beyond an allocated buffer because it supports sequence indexes up to 32 while allocating only 17 entries. The issue affects systems using the Kvaser PCIe CAN driver on vulnerable kernels. It requires local access according to the supplied CVSS vector and is not documented as remotely exploitable.

Executive priority

Prioritize affected industrial, automotive, laboratory, or operational systems where CAN disruption or kernel compromise would have material consequences. Patch through normal emergency kernel procedures after confirming driver use. Systems without the Kvaser PCIe CAN driver or hardware are unlikely to be exposed, but version and backport status should be verified.

Technical view

In kvaser_pciefd, echo_skb[] was allocated for 17 entries, but echo_skb_max could be rounded to 32. Transmission or acknowledgement indexes could consequently exceed the array boundary. KASAN observed an out-of-bounds read in kvaser_pciefd_handle_ack_packet during interrupt processing. The upstream fix sizes echo_skb[] for the rounded maximum sequence value.

Likely exposure

Exposure is limited to Linux systems running an affected kernel and actively using the kvaser_pciefd driver for Kvaser PCIe CAN hardware. The supplied version data includes upstream versions and commits but does not reliably identify distribution backports. Internet-facing status alone is not a useful exposure indicator because the supplied CVSS vector specifies local access.

Exploitation context

The supplied score is CVSS 3.1 7.8 with local, low-complexity, low-privilege access and potential high confidentiality, integrity, and availability impact. The flaw was found by Syzkaller and reproduced with KASAN. It is not in KEV, and the bundle provides no evidence of active exploitation or a public weaponized exploit.

Researcher notes

The core invariant failure is a mismatch between the 17-entry allocation and a sequence-number limit rounded to 32. KASAN demonstrated an eight-byte out-of-bounds read in the acknowledgement path; the transmission path reportedly detects the same condition earlier. Sources describe the correction as increasing the underlying echo array. They do not establish practical privilege escalation or attacker-controlled exploitation.

Mitigation direction

  • Install a vendor-supported kernel containing the applicable upstream stable fix.
  • Confirm distribution backports rather than relying only on the displayed kernel version.
  • If patching is delayed, consult vendor guidance for supported temporary risk reduction.
  • Assess whether affected Kvaser PCIe CAN hardware can be safely removed from service.

Validation and detection

  • Inventory systems using the kvaser_pciefd driver and Kvaser PCIe CAN hardware.
  • Map kernel packages to vendor advisories and backported fix commits.
  • Confirm the applicable stable fix is present in deployed kernel source or package metadata.
  • Review kernel and KASAN logs for kvaser_pciefd out-of-bounds reports or crashes.
  • Exercise normal CAN transmission and acknowledgement handling in a controlled test environment after updating.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38224 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-38224Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux352fbde14177d608a54120b6ff559ce5b3cf6238, 8256e0ca601051933e9395746817f3801fa9a6bf, 8256e0ca601051933e9395746817f3801fa9a6bf, f14512f3ee09cda986191c8dd7f54972afa2c763, 6.12.31, 6.14.9unaffected
LinuxLinux6.15, 0, 6.12.35, 6.15.4, 6.16affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.