CVE-2025-71182

can: j1939: make j1939_session_activate() fail if device is no longer registered

State: Published
Severity: Not scored
Published: Jan 31, 2026
Updated: Oct 19, 2026
Reserved: Jan 31, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

can: j1939: make j1939_session_activate() fail if device is no longer registered

syzbot is still reporting

unregister_netdevice: waiting for vcan0 to become free. Usage count = 2

even after commit 93a27b5891b8 ("can: j1939: add missing calls in NETDEV_UNREGISTER notification handler") was added. A debug printk() patch found that j1939_session_activate() can succeed even after j1939_cancel_active_session() from j1939_netdev_notify(NETDEV_UNREGISTER) has completed.

Since j1939_cancel_active_session() is processed with the session list lock held, checking ndev->reg_state in j1939_session_activate() with the session list lock held can reliably close the race window.

Scores

The record has no CVSS score.

Weaknesses

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

Product	Versions
LinuxLinux	9d71dd0c70099914fcd063135da3c580865e924c to before ebb0dfd718dd31c8d3600612ca4b7207ec3d923aAffected 9d71dd0c70099914fcd063135da3c580865e924c to before c3a4316e3c746af415c0fd6c6d489ad13f53714dAffected 9d71dd0c70099914fcd063135da3c580865e924c to before 46ca9dc978923c5e1247a9e9519240ba7ace413cAffected 9d71dd0c70099914fcd063135da3c580865e924c to before 78d87b72cebe2a993fd5b017e9f14fb6278f2eaeAffected 9d71dd0c70099914fcd063135da3c580865e924c to before ba6f0d1832eeb5eb3a6dc5cb30e0f720b3cb3536Affected 9d71dd0c70099914fcd063135da3c580865e924c to before 79dd3f1d9dd310c2af89b09c71f34d93973b200fAffected 9d71dd0c70099914fcd063135da3c580865e924c to before 5d5602236f5db19e8b337a2cd87a90ace5ea776dAffected
LinuxLinux	5.4Affected before 5.4Not affected 5.10.248 through 5.10.Not affected 5.15.198 through 5.15.Not affected 6.1.161 through 6.1.Not affected 6.6.121 through 6.6.Not affected 6.12.66 through 6.12.Not affected 6.18.6 through 6.18.Not affected 6.19 and laterNot affected

Product

Versions

LinuxLinux

9d71dd0c70099914fcd063135da3c580865e924c to before ebb0dfd718dd31c8d3600612ca4b7207ec3d923aAffected
9d71dd0c70099914fcd063135da3c580865e924c to before c3a4316e3c746af415c0fd6c6d489ad13f53714dAffected
9d71dd0c70099914fcd063135da3c580865e924c to before 46ca9dc978923c5e1247a9e9519240ba7ace413cAffected
9d71dd0c70099914fcd063135da3c580865e924c to before 78d87b72cebe2a993fd5b017e9f14fb6278f2eaeAffected
9d71dd0c70099914fcd063135da3c580865e924c to before ba6f0d1832eeb5eb3a6dc5cb30e0f720b3cb3536Affected
9d71dd0c70099914fcd063135da3c580865e924c to before 79dd3f1d9dd310c2af89b09c71f34d93973b200fAffected
9d71dd0c70099914fcd063135da3c580865e924c to before 5d5602236f5db19e8b337a2cd87a90ace5ea776dAffected

LinuxLinux

5.4Affected
before 5.4Not affected
5.10.248 through 5.10.*Not affected
5.15.198 through 5.15.*Not affected
6.1.161 through 6.1.*Not affected
6.6.121 through 6.6.*Not affected
6.12.66 through 6.12.*Not affected
6.18.6 through 6.18.*Not affected
6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.