The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow Sending an PF_PACKET allows to     bypass the CAN framework logic and to directly reach the xmit() function of a CAN driver. The only check     which is performed by the PF_PACKET framework is to make sure that skb->len fits the interface's MTU.
    Unfortunately, because the etas_es58x driver does not populate its net_device_ops->ndo_change_mtu(), it is     possible for an attacker to configure an invalid MTU by doing, for example: $ ip link set can0 mtu 9999     After doing so, the attacker could open a PF_PACKET socket using the ETH_P_CANXL protocol:
    socket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL)); to inject a malicious CAN XL frames. For example: struct     canxl_frame frame = { .flags = 0xff, .len = 2048, }; The CAN drivers' xmit() function are calling     can_dev_dropped_skb() to check that the skb is valid, unfortunately under above conditions, the malicious     packet is able to go through can_dev_dropped_skb() checks: 1. the skb->protocol is set to ETH_P_CANXL     which is valid (the function does not check the actual device capabilities). 2. the length is a valid CAN     XL length. And so, es58x_start_xmit() receives a CAN XL frame which it is not able to correctly handle and     will thus misinterpret it as a CAN(FD) frame. This can result in a buffer overflow. For example, using the     es581.4 variant, the frame will be dispatched to es581_4_tx_can_msg(), go through the last check at the     beginning of this function: if (can_is_canfd_skb(skb)) return -EMSGSIZE; and reach this line:
    memcpy(tx_can_msg->data, cf->data, cf->len); Here, cf->len corresponds to the flags field of the CAN XL     frame. In our previous example, we set canxl_frame->flags to 0xff. Because the maximum expected length is     8, a buffer overflow of 247 bytes occurs! Populate net_device_ops->ndo_change_mtu() to ensure that the     interface's MTU can not be set to anything bigger than CAN_MTU or CANFD_MTU (depending on the device     capabilities). By fixing the root cause, this prevents the buffer overflow. (CVE-2025-39988)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-39988

high Nessus Plugin ID 271561

Version 1.3

Version 1.1

Version 1.3 Nov 26, 2025, 1:15 PM CVSS metrics ("CVSSv2 score" set to 9.7. "CVSSv3 vector" set to "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H". "CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:P/A:C". "CVSSv3 score" set to 7.1. "CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H") Detection (updated detection logic) Plugin metadata Plugin Feed: 202511261315
Version 1.1 Oct 27, 2025, 6:34 AM New Plugin Feed: 202510270634