Spin Lock Initialization Vulnerability in Linux Kernel Affecting CAN Devices

CVE-2025-37993

What is CVE-2025-37993?

A vulnerability exists in the Linux kernel related to the initialization of the spin lock 'tx_handling_spinlock' within the 'm_can_classdev' structure. When the kernel attempts to send CAN frames using 'cansend' from 'can-utils', it may produce a 'spinlock bad magic' error due to the uninitialized state of the spin lock. This issue can lead to unexpected behavior and potential system instability. Proper initialization of the spin lock in 'm_can_class_allocate_dev' effectively addresses this vulnerability, enhancing the reliability of CAN communications in Linux systems.

References