CVE-2025-40107

can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled

State
Published
Severity
Not scored
Published
Nov 3, 2025
Updated
May 11, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled

This issue is similar to the vulnerability in the `mcp251x` driver, which was fixed in commit 03c427147b2d ("can: mcp251x: fix resume from sleep before interface was brought up").

In the `hi311x` driver, when the device resumes from sleep, the driver schedules `priv->restart_work`. However, if the network interface was not previously enabled, the `priv->wq` (workqueue) is not allocated and initialized, leading to a null pointer dereference.

To fix this, we move the allocation and initialization of the workqueue from the `hi3110_open` function to the `hi3110_can_probe` function. This ensures that the workqueue is properly initialized before it is used during device resume. And added logic to destroy the workqueue in the error handling paths of `hi3110_can_probe` and in the `hi3110_can_remove` function to prevent resource leaks.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 57e83fb9b7468c75cb65cde1d23043553c346c6d to before d1fc4c041459e2d4856c1b2501486ba4f0cbf96bAffected
  • 57e83fb9b7468c75cb65cde1d23043553c346c6d to before e93af787187e585933570563c643337fa731584aAffected
  • 57e83fb9b7468c75cb65cde1d23043553c346c6d to before 1d2ef21f02baff0c109ad78b9e835fb4acb14533Affected
  • 57e83fb9b7468c75cb65cde1d23043553c346c6d to before fd00cf38fd437c979f0e5905e3ebdfc3f55a4b96Affected
  • 57e83fb9b7468c75cb65cde1d23043553c346c6d to before 6b696808472197b77b888f50bc789a3bae077743Affected
LinuxLinux
  • 4.12Affected
  • before 4.12Not affected
  • 6.1.156 through 6.1.*Not affected
  • 6.6.111 through 6.6.*Not affected
  • 6.12.52 through 6.12.*Not affected
  • 6.16.12 through 6.16.*Not affected
  • 6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.