CVE-2026-63990 Affecting kernel-default-livepatch package, versions <6.4.0-150700.53.81.1
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-SLES157-KERNELDEFAULTLIVEPATCH-19907325
- published18 Sept 2026
- disclosed17 Sept 2026
Introduced: 17 Sep 2026
NewCVE-2026-63990 (opens in a new tab)How to fix?
Upgrade SLES:15.7 kernel-default-livepatch to version 6.4.0-150700.53.81.1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel-default-livepatch package and not the kernel-default-livepatch package as distributed by SLES.
See How to fix? for SLES:15.7 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
bonding: refuse to enslave CAN devices
syzbot reported a kernel paging request crash in can_rx_unregister() inside net/can/af_can.c. The crash occurs because a virtual CAN device (vxcan) is being enslaved to a bonding master.
During the enslavement process, the bonding driver mutates and modifies the network device states to fit an Ethernet-like aggregation model. However, CAN devices operate on a completely different Layer 2 architecture, relying on the CAN mid-layer private data structure (can_ml_priv) instead of standard Ethernet structures. Since bonding does not initialize or maintain these CAN structures, subsequent operations on the half-enslaved interface (such as closing associated sockets via isotp_release) lead to a null-pointer dereference when accessing the CAN receiver lists.
Bonding CAN interfaces is architecturally invalid as CAN lacks MAC addresses, ARP capabilities, and standard Ethernet link-layer mechanisms. While generic loopback devices are blocked globally in net/core/dev.c, virtual CAN devices bypass this check because they do not carry the IFF_LOOPBACK flag, despite acting as local software-loopbacks.
Fix this by explicitly blocking network devices of type ARPHRD_CAN from being enslaved at the very beginning of bond_enslave(). This prevents illegal state mutations, eliminates the resulting KASAN crashes, and avoids potential memory leaks from incomplete socket cleanups.
As the CAN support has been added a long time after bonding the Fixes-tag points to the introduction of ARPHRD_CAN that would have needed a specific handling in bonding_main.c.
References
- https://www.suse.com/security/cve/CVE-2026-63990.html
- https://bugzilla.suse.com/1273027
- https://git.kernel.org/stable/c/02f1c87ded33b43d48b4a1d665da15f2157b30d8
- https://git.kernel.org/stable/c/41e8478c4cd896d3abbe33d41afc90c84ac66602
- https://git.kernel.org/stable/c/563090e5d450c665f70d955a39f9587afc7842eb
- https://git.kernel.org/stable/c/69b78b5f3033272e53a2dc2dad675962654a5b38
- https://git.kernel.org/stable/c/8ba68464e4787b6a7ec938826e16124df20fd23d
- https://git.kernel.org/stable/c/9ea8a648d9120f7652bcde1ce2c4ad66871af707
- https://git.kernel.org/stable/c/f4d78a81f57df82e9d82a2c07471fed1a1235893