CVE-2023-54039: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54039 is an out-of-bounds memory access vulnerability in the Linux kernel's CAN J1939 transport protocol implementation, specifically in the j1939_tp_tx_dat_new() function. The flaw occurs during a memcpy() operation that incorrectly uses the size of skb->cb rather than the size of struct j1939_sk_buff_cb, potentially reading beyond the bounds of the structure. It affects Linux kernel versions from the introduction of the J1939 subsystem (commit 9d71dd0c7009) up to the patched stable releases: 5.4.241, 5.10.178, 5.15.107, 6.1.24, 6.2.11, and 6.3. The CVE was published on December 24, 2025, and Feedly estimates the severity as HIGH; NVD has not yet completed enrichment with a formal CVSS score (Feedly, NVD).

The root cause is an improper bounds check (CWE-125: Out-of-bounds Read) in the j1939_tp_tx_dat_new() function within the Linux kernel's net/can/j1939/transport.c. The memcpy() call used sizeof(skb->cb) as the copy length, but since skb->cb is a generic kernel socket buffer control block that may be larger than struct j1939_sk_buff_cb, this caused a read beyond the intended structure boundary. The fix corrects the memcpy() to use sizeof(struct j1939_sk_buff_cb) and adds a compile-time BUILD_BUG_ON() assertion to ensure skb->cb is always at least as large as j1939_sk_buff_cb, preventing future regressions. Exploitation would require local access to a system with the J1939 CAN subsystem loaded and the ability to send crafted CAN frames or interact with J1939 sockets (NVD, Feedly).

Successful exploitation of this out-of-bounds read could allow a local attacker to read kernel memory beyond the intended buffer, potentially exposing sensitive kernel data or facilitating information disclosure. In certain configurations, such memory corruption bugs in kernel networking code can also contribute to system instability or kernel panics, impacting availability. The vulnerability is confined to systems with the CAN J1939 subsystem active, which is most relevant in automotive, industrial control, and embedded Linux environments (NVD, Feedly).

The Linux kernel project has released patches across multiple stable branches. Users should upgrade to the following fixed versions or later: 5.4.241, 5.10.178, 5.15.107, 6.1.24, 6.2.11, or 6.3 (Feedly, NVD). As a workaround on systems that do not require J1939 CAN support, administrators can unload or blacklist the can-j1939 kernel module (modprobe -r can_j1939 or adding blacklist can_j1939 to /etc/modprobe.d/) to eliminate the attack surface. Distribution-specific updates (e.g., Red Hat, Debian, Ubuntu) should be applied as they become available through vendor channels.