CVE-2023-54105 can: isotp: check CAN address family in isotp_bind()
A missing check in the Linux kernel CAN ISOTP module allows binding with incorrect address families, potentially leading to unexpected behavior or information leakage.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-54105?
CVE-2023-54105 is a missing authorization vulnerability in Linux, published on 24 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
can: isotp: check CAN address family in isotp_bind()
Add missing check to block non-AF_CAN binds.
Syzbot created some code which matched the right sockaddr struct size but used AF_XDP (0x2C) instead of AF_CAN (0x1D) in the address family field:
bind$xdp(r2, &(0x7f0000000540)={0x2c, 0x0, r4, 0x0, r2}, 0x10) ^^^^ This has no funtional impact but the userspace should be notified about the wrong address family field content.
Which versions are affected by CVE-2023-54105?
How do I fix CVE-2023-54105?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-54105 being exploited?
There is no known exploitation of CVE-2023-54105 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2023-54105, DEBIAN-CVE-2023-54105, GHSA-pg9h-x33j-cfq7, ROOT-OS-UBUNTU-2204-CVE-2023-54105, ROOT-OS-UBUNTU-2404-CVE-2023-54105, UBUNTU-CVE-2023-54105.