CVE-2026-63990

In the Linux kernel, the following vulnerability has been resolved:

bonding: refuse to enslave CAN devices

syzbot reported a kernel paging request crash in

can_rx_unregister() inside net/can/af_can.c. The crash occurs

because a virtual CAN device (vxcan) is being enslaved to a

bonding master.

During the enslavement process, the bonding driver mutates

and modifies the network device states to fit an Ethernet-like

aggregation model. However, CAN devices operate on a completely

different Layer 2 architecture, relying on the CAN mid-layer

private data structure (can_ml_priv) instead of standard

Ethernet structures. Since bonding does not initialize or

maintain these CAN structures, subsequent operations on the

half-enslaved interface (such as closing associated sockets

via isotp_release) lead to a null-pointer dereference when

accessing the CAN receiver lists.

Bonding CAN interfaces is architecturally invalid as CAN lacks

MAC addresses, ARP capabilities, and standard Ethernet

link-layer mechanisms. While generic loopback devices are

blocked globally in net/core/dev.c, virtual CAN devices

bypass this check because they do not carry the IFF_LOOPBACK

flag, despite acting as local software-loopbacks.

Fix this by explicitly blocking network devices of type

ARPHRD_CAN from being enslaved at the very beginning of

bond_enslave(). This prevents illegal state mutations,

eliminates the resulting KASAN crashes, and avoids potential

memory leaks from incomplete socket cleanups.

As the CAN support has been added a long time after bonding

the Fixes-tag points to the introduction of ARPHRD_CAN that

would have needed a specific handling in bonding_main.c.