linux-cve-announce - CVE-2025-40107: can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025110316-CVE-2025-40107-5bac@gregkh>
Date: Mon,  3 Nov 2025 21:15:16 +0900
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-40107: can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled

This issue is similar to the vulnerability in the `mcp251x` driver,
which was fixed in commit 03c427147b2d ("can: mcp251x: fix resume from
sleep before interface was brought up").

In the `hi311x` driver, when the device resumes from sleep, the driver
schedules `priv->restart_work`. However, if the network interface was
not previously enabled, the `priv->wq` (workqueue) is not allocated and
initialized, leading to a null pointer dereference.

To fix this, we move the allocation and initialization of the workqueue
from the `hi3110_open` function to the `hi3110_can_probe` function.
This ensures that the workqueue is properly initialized before it is
used during device resume. And added logic to destroy the workqueue
in the error handling paths of `hi3110_can_probe` and in the
`hi3110_can_remove` function to prevent resource leaks.

The Linux kernel CVE team has assigned CVE-2025-40107 to this issue.

Affected and fixed versions
===========================

	Fixed in 6.1.156 with commit d1fc4c041459e2d4856c1b2501486ba4f0cbf96b
	Fixed in 6.6.111 with commit e93af787187e585933570563c643337fa731584a
	Fixed in 6.12.52 with commit 1d2ef21f02baff0c109ad78b9e835fb4acb14533
	Fixed in 6.16.12 with commit fd00cf38fd437c979f0e5905e3ebdfc3f55a4b96
	Fixed in 6.17 with commit 6b696808472197b77b888f50bc789a3bae077743

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-40107
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	drivers/net/can/spi/hi311x.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/d1fc4c041459e2d4856c1b2501486ba4f0cbf96b
	https://git.kernel.org/stable/c/e93af787187e585933570563c643337fa731584a
	https://git.kernel.org/stable/c/1d2ef21f02baff0c109ad78b9e835fb4acb14533
	https://git.kernel.org/stable/c/fd00cf38fd437c979f0e5905e3ebdfc3f55a4b96
	https://git.kernel.org/stable/c/6b696808472197b77b888f50bc789a3bae077743