CVE-2025-40107

Root

Cause

The vulnerability in the hi311x CAN driver is a null pointer dereference that occurs when the system resumes from a sleep state before the network interface has been brought up. The root cause is that the driver's workqueue (priv->wq) is allocated and initialized in the hi3110_open function, but the resume path schedules priv->restart_work without first checking whether the workqueue exists. If the interface was never opened, priv->wq remains NULL, leading to a crash when the scheduler tries to queue work on it. This mirrors a similar bug in the mcp251x driver that was previously fixed [1].

Exploitation

An attacker would need to be able to trigger a suspend/resume cycle on a system using the hi311x CAN controller. No authentication or special privileges are required beyond the ability to put the system to sleep (e.g., via S3 sleep or hibernation). The vulnerability). The attack does not require any network access; it is a local issue that can be triggered simply by resuming from sleep before the CAN interface has been activated. The prerequisite is that the driver must be loaded and the device present, but the interface must not have been brought up via `ip link set can0 up [2].

Impact

Exploiting this vulnerability causes a kernel NULL pointer dereference, which typically results in an immediate system crash (kernel oops) or denial of service. In some configurations, it might be leveraged for local privilege escalation if the attacker can control the content near NULL in memory, though the primary impact is system availability. The bug specifically targets the CAN subsystem and can render the system unusable until reboot.

Mitigation

The fix moves the workqueue allocation from hi3110_open to the probe function hi3110_can_probe, ensuring the workqueue is created before any resume can occur. The patch also adds proper cleanup in error paths and in the remove function to prevent resource leaks [3]. The fix has been applied to the stable kernel trees; users should update their kernels to a version containing the commit. No workaround is available besides avoiding suspend/resume cycles until the patch is applied.