In the Linux kernel, the following vulnerability has been resolved: bonding: refuse to enslave CAN devices syzbot reported a kernel paging request crash in can_rx_unregister() inside net/can/af_can.c. The crash occurs because a virtual CAN device (vxcan) is being enslaved to a bonding master. During the enslavement process, the bonding driver mutates and modifies the network device states to fit an Ethernet-like aggregation model. However, CAN devices operate on a completely different Layer 2 architecture, relying on the CAN mid-layer private data structure (can_ml_priv) instead of standard Ethernet structures. Since bonding does not initialize or maintain these CAN structures, subsequent operations on the half-enslaved interface (such as closing associated sockets via isotp_release) lead to a null-pointer dereference when accessing the CAN receiver lists. Bonding CAN interfaces is architecturally invalid as CAN lacks MAC addresses, ARP capabilities, and standard Ethernet link-layer mechanisms. While generic loopback devices are blocked globally in net/core/dev.c, virtual CAN devices bypass this check because they do not carry the IFF_LOOPBACK flag, despite acting as local software-loopbacks. Fix this by explicitly blocking network devices of type ARPHRD_CAN from being enslaved at the very beginning of bond_enslave(). This prevents illegal state mutations, eliminates the resulting KASAN crashes, and avoids potential memory leaks from incomplete socket cleanups. As the CAN support has been added a long time after bonding the Fixes-tag points to the introduction of ARPHRD_CAN that would have needed a specific handling in bonding_main.c.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - bonding: refuse to enslave CAN devices syzbot reported a kernel paging request crash in     can_rx_unregister() inside net/can/af_can.c. The crash occurs because a virtual CAN device (vxcan) is     being enslaved to a bonding master. During the enslavement process, the bonding driver mutates and     modifies the network device states to fit an Ethernet-like aggregation model. However, CAN devices operate     on a completely different Layer 2 architecture, relying on the CAN mid-layer private data structure     (can_ml_priv) instead of standard Ethernet structures. Since bonding does not initialize or maintain these     CAN structures, subsequent operations on the half-enslaved interface (such as closing associated sockets     via isotp_release) lead to a null-pointer dereference when accessing the CAN receiver lists. Bonding CAN     interfaces is architecturally invalid as CAN lacks MAC addresses, ARP capabilities, and standard Ethernet     link-layer mechanisms. While generic loopback devices are blocked globally in net/core/dev.c, virtual CAN     devices bypass this check because they do not carry the IFF_LOOPBACK flag, despite acting as local     software-loopbacks. Fix this by explicitly blocking network devices of type ARPHRD_CAN from being enslaved     at the very beginning of bond_enslave(). This prevents illegal state mutations, eliminates the resulting     KASAN crashes, and avoids potential memory leaks from incomplete socket cleanups. As the CAN support has     been added a long time after bonding the Fixes-tag points to the introduction of ARPHRD_CAN that would     have needed a specific handling in bonding_main.c. (CVE-2026-63990)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
347900	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4254-1)	Nessus	SuSE Local Security Checks	Local	high
343532	Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (GCP) vulnerabilities (USN-8728-1)	Nessus	Ubuntu Local Security Checks	Local	high
343049	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500248)	Nessus	Oracle Linux Local Security Checks	Local	high
340681	Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8663-1)	Nessus	Ubuntu Local Security Checks	Local	high
340045	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)	Nessus	Ubuntu Local Security Checks	Local	high
333941	Photon OS 5.0: Linux PHSA-2026-5.0-92-0926	Nessus	PhotonOS Local Security Checks	Local	high
333762	Photon OS 5.0: Linux PHSA-2026-5.0-92-0895	Nessus	PhotonOS Local Security Checks	Local	high
329326	Photon OS 5.0: Linux PHSA-2026-5.0-0926	Nessus	PhotonOS Local Security Checks	Local	high
328499	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2026-110 (ALASKERNEL-5.15-2026-110)	Nessus	Amazon Linux Local Security Checks	Local	medium
328493	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1968)	Nessus	Amazon Linux Local Security Checks	Local	high
327960	Linux Distros Unpatched Vulnerability : CVE-2026-63990	Nessus	Misc.	Local	medium
327380	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-1924)	Nessus	Amazon Linux Local Security Checks	Local	high
322944	Photon OS 5.0: Linux PHSA-2026-5.0-0895	Nessus	PhotonOS Local Security Checks	Local	high
322087	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1881)	Nessus	Amazon Linux Local Security Checks	Local	high

Detections

Analytics

CVE-2026-63990

medium

Tenable Plugins

high

high

high

high

high

high

high

high

medium

high

medium

high

high

high