CVE-2025-71182

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> can: j1939: make j1939_session_activate() fail if device is no longer registered<br /> <br /> syzbot is still reporting<br /> <br /> unregister_netdevice: waiting for vcan0 to become free. Usage count = 2<br /> <br /> even after commit 93a27b5891b8 ("can: j1939: add missing calls in<br /> NETDEV_UNREGISTER notification handler") was added. A debug printk() patch<br /> found that j1939_session_activate() can succeed even after<br /> j1939_cancel_active_session() from j1939_netdev_notify(NETDEV_UNREGISTER)<br /> has completed.<br /> <br /> Since j1939_cancel_active_session() is processed with the session list lock<br /> held, checking ndev-&gt;reg_state in j1939_session_activate() with the session<br /> list lock held can reliably close the race window.