Vulnerability in the Linux Kernel Affecting CAN Device Bonding Functionality

CVE-2026-63990

What is CVE-2026-63990?

This vulnerability arises when attempting to enslave virtual CAN devices to a bonding master within the Linux kernel. The bonding driver modifies network device states intended for Ethernet aggregation, leading to the potential for null-pointer dereference errors during socket operations due to improper handling of the CAN architecture. To mitigate this issue, an explicit check is implemented to prevent CAN devices from being enslaved, ensuring the integrity of the bonding architecture and preventing changes that could cause system instability or memory leaks.

References