CVE-2026-63990

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A kernel paging request crash occurs in the can rx unregister() function within net/can/af can.c when a virtual CAN device (vxcan) is enslaved to a bonding master. This happens because the bonding driver modifies network device states to follow an Ethernet-like aggregation model, but CAN devices use a different Layer 2 architecture based on the can ml priv private data structure. Because bonding does not initialize these CAN structures, operations like closing sockets via isotp release result in a null-pointer dereference. This issue exists because virtual CAN devices bypass global loopback checks as they lack the IFF LOOPBACK flag. The flaw is triggered during the bond enslave() process when handling devices of type ARPHRD CAN.

Recommendations As a temporary workaround, avoid enslaving CAN devices to a bonding master. At the moment, there is no information about a newer version that contains a fix for this vulnerability.