CVE-2025-21775 – A NULL pointer dereference vulnerability in the... (How to Fix)

Q: What is the severity of CVE-2025-21775?

CVE-2025-21775 has a CVSS score of 5.5 (MEDIUM). A NULL pointer dereference vulnerability in the Linux kernel's ctucanfd CAN bus driver could cause kernel crashes or system instability when skb allocation fails. This affects systems using the ctucanfd driver for CAN bus communication, primarily embedded Linux devices and automotive systems. The vulnerability requires local access or ability to trigger CAN bus error conditions.

📋 TL;DR

A NULL pointer dereference vulnerability in the Linux kernel's ctucanfd CAN bus driver could cause kernel crashes or system instability when skb allocation fails. This affects systems using the ctucanfd driver for CAN bus communication, primarily embedded Linux devices and automotive systems. The vulnerability requires local access or ability to trigger CAN bus error conditions.

💻 Affected Systems

Products:

Linux kernel with ctucanfd driver

Versions: Linux kernel versions containing vulnerable ctucanfd driver code prior to fixes in stable branches

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only vulnerable if ctucanfd driver is loaded and used for CAN bus communication.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, potentially causing safety issues in automotive or industrial control systems.

🟠

Likely Case

System instability or kernel crash requiring reboot, causing temporary denial of service.

🟢

If Mitigated

Minimal impact with proper access controls and monitoring in place.

🌐 Internet-Facing: LOW - Requires local access or CAN bus interface access.

🏢 Internal Only: MEDIUM - Could be exploited by malicious insiders or through compromised internal systems with CAN bus access.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires ability to trigger CAN bus error conditions or control skb allocation failures through other means.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel stable releases containing commits: 84b9ac59978a6a4e0812d1c938fad97306272cef, 9bd24927e3eeb85642c7baa3b28be8bea6c2a078, b0e592dd46a0a952b41c3bf6c963afdd6a42b526, e505b83b9ee6aa0ae2f4395f573a66579ae403fb, e7e2e2318b1f085044126ba553a4e619842fc36d

Vendor Advisory: https://git.kernel.org/stable/c/84b9ac59978a6a4e0812d1c938fad97306272cef

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from official distribution repositories. 2. Rebuild kernel if using custom kernel. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable ctucanfd driver

linux

Unload or blacklist the vulnerable ctucanfd driver if CAN bus functionality is not required.

modprobe -r ctucanfd
echo 'blacklist ctucanfd' >> /etc/modprobe.d/blacklist.conf

🧯 If You Can't Patch

Restrict access to CAN bus interfaces and system users who can trigger CAN error conditions.
Implement monitoring for kernel crashes and system instability related to CAN bus operations.

🔍 How to Verify

Check if Vulnerable:

Check if ctucanfd driver is loaded: lsmod | grep ctucanfd. Check kernel version against patched releases.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated and ctucanfd driver version includes the NULL check fix.

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
NULL pointer dereference errors in kernel logs
System crash reports related to CAN bus

Network Indicators:

Unusual CAN bus traffic patterns triggering error conditions

SIEM Query:

source="kernel" AND ("NULL pointer" OR "kernel panic" OR "ctucanfd")

📊 Metadata

CVE ID: CVE-2025-21775

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

EPSS Score: 0.05% exploit probability (13.7th percentile)

Published: February 27, 2025

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-21775, you might also want to check these: