Medium 5.5Published Oct 1, 2025

CVE-2025-39925can: j1939: implement NETDEV_UNREGISTER notification handler

Updated under an hour ago (Oct 28, 2026, 3:50 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: can: j1939: implement NETDEV_UNREGISTER notification handler syzbot is reporting unregister_netdevice: waiting for vcan0 to become free. Usage count = 2 problem, for j1939 protocol did not have NETDEV_UNREGISTER notification handler for undoing changes made by j1939_sk_bind(). Commit 25fe97cb7620 ("can: j1939: move j1939_priv_put() into sk_destruct callback") expects that a call to j1939_priv_put() can be unconditionally delayed until j1939_sk_sock_destruct() is called. But we need to call j1939_priv_put() against an extra ref held by j1939_sk_bind() call (as a part of undoing changes made by j1939_sk_bind()) as soon as NETDEV_UNREGISTER notification fires (i.e. before j1939_sk_sock_destruct() is called via j1939_sk_release()). Otherwise, the extra ref on "struct j1939_priv" held by j1939_sk_bind() call prevents "struct net_device" from dropping the usage count to 1; making it impossible for unregister_netdevice() to continue. [mkl: remove space in front of label]

CVSS: 5.5 MEDIUM (v3.1, CISA ADP)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Sep 2, 2026
First seen by InfoSec Signals: Oct 19, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 9d71dd0c70099914fcd063135da3c580865e924c before 479d8a2aedcc1db16f14c1a8a9c74b5bdf18b9ac; 9d71dd0c70099914fcd063135da3c580865e924c builds before 2c88069fac2c792e228e6a4ae71c9b9b5b9a87a6; from 9d71dd0c70099914fcd063135da3c580865e924c before 76957b618ce729c3bd1e782fbc9d9991af653925; 9d71dd0c70099914fcd063135da3c580865e924c builds before 4e154cb5e7681c2910e2dfa09f05e3469e333745; from 9d71dd0c70099914fcd063135da3c580865e924c before da9e8f429139928570407e8f90559b5d46c20262; 9d71dd0c70099914fcd063135da3c580865e924c builds before 7fcbe5b2c6a4b5407bf2241fdb71e0a390f6ab9a	CNA record
linux linux_kernel linux:linux_kernel	from 5.4 before 6.16.8; 6.17; 6.17; 6.17; 6.17; 6.17	NVD

References

References

https://git.kernel.org/stable/c/479d8a2aedcc1db16f14c1a8a9c74b5bdf18b9ac
https://git.kernel.org/stable/c/2c88069fac2c792e228e6a4ae71c9b9b5b9a87a6
https://git.kernel.org/stable/c/76957b618ce729c3bd1e782fbc9d9991af653925
https://git.kernel.org/stable/c/4e154cb5e7681c2910e2dfa09f05e3469e333745
https://git.kernel.org/stable/c/da9e8f429139928570407e8f90559b5d46c20262	patch
https://git.kernel.org/stable/c/7fcbe5b2c6a4b5407bf2241fdb71e0a390f6ab9a	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.