Linux Kernel Bonding Driver Improperly Enslaves CAN Devices, Leading to Crashes

A vulnerability in the Linux kernel bonding driver can cause a kernel crash when a virtual CAN device is enslaved to a bonding master. This issue arises because the bonding driver modifies network device states to conform to an Ethernet-like model, which is incompatible with CAN's distinct Layer 2 architecture. The bonding process fails to manage CAN-specific data structures, resulting in a null-pointer dereference and a crash when accessing CAN receiver lists. This vulnerability is particularly problematic because CAN lacks MAC addresses and standard Ethernet link-layer mechanisms, making the bonding operation architecturally invalid.

Impact

Enslaving CAN devices to a bonding master leads to kernel crashes caused by null-pointer dereferences, disrupting CAN communication and potentially causing data loss or corruption.

Reproduction

The vulnerability can be reproduced by creating a virtual CAN device and attempting to enslave it to a bonding master. During this process, the bonding driver will improperly handle the CAN device, leading to a crash.

Remediation

The vulnerability has been addressed in upstream Linux kernel commits. Users should upgrade to a version that includes these commits to avoid the issue.