Riskcovery

CVE-2025-21773

can: etas_es58x: fix potential NULL pointer dereference on udev->serial

State
Published
Severity
5.5 Medium
Published
Feb 27, 2025
Updated
May 11, 2026
Reserved
Dec 29, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

can: etas_es58x: fix potential NULL pointer dereference on udev->serial

The driver assumed that es58x_dev->udev->serial could never be NULL. While this is true on commercially available devices, an attacker could spoof the device identity providing a NULL USB serial number. That would trigger a NULL pointer dereference.

Add a check on es58x_dev->udev->serial before accessing it.

Scores

CVSSScoreVectorSource
3.15.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCISA-ADP

Weaknesses

Affected Products

ProductVersions
LinuxLinux
  • 9f06631c3f1f0f298536443df85a6837ba4c5f5c to before 1590667a60753ee5a54871f2840ceefd4a7831faAffected
  • 9f06631c3f1f0f298536443df85a6837ba4c5f5c to before 722e8e1219c8b6ac2865011fe339315d6a8d0721Affected
  • 9f06631c3f1f0f298536443df85a6837ba4c5f5c to before 5059ea98d7bc133903d3e47ab36df6ed11d0c95fAffected
  • 9f06631c3f1f0f298536443df85a6837ba4c5f5c to before a1ad2109ce41c9e3912dadd07ad8a9c640064ffbAffected
LinuxLinux
  • 6.2Affected
  • before 6.2Not affected
  • 6.6.79 through 6.6.*Not affected
  • 6.12.16 through 6.12.*Not affected
  • 6.13.4 through 6.13.*Not affected
  • 6.14 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.