CVE-2026-63990

A flaw was found in the Linux kernel's bonding driver. This vulnerability allows a local user to cause a kernel crash, leading to a Denial of Service (DoS), by attempting to enslave a virtual Controller Area Network (CAN) device to a bonding master. The bonding driver, designed for Ethernet-like devices, does not properly handle CAN devices, resulting in a null-pointer dereference during subsequent network operations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.