CVE-2025-37993

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

can: m_can: m_can_class_allocate_dev(): initialize spin lock on device probe

The spin lock tx_handling_spinlock in struct m_can_classdev is not

being initialized. This leads the following spinlock bad magic

complaint from the kernel, eg. when trying to send CAN frames with

cansend from can-utils:

| BUG: spinlock bad magic on CPU#0, cansend/95

| lock: 0xff60000002ec1010, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0

| CPU: 0 UID: 0 PID: 95 Comm: cansend Not tainted 6.15.0-rc3-00032-ga79be02bba5c #5 NONE

| Hardware name: MachineWare SIM-V (DT)

| Call Trace:

| [<ffffffff800133e0>] dump_backtrace+0x1c/0x24

| [<ffffffff800022f2>] show_stack+0x28/0x34

| [<ffffffff8000de3e>] dump_stack_lvl+0x4a/0x68

| [<ffffffff8000de70>] dump_stack+0x14/0x1c

| [<ffffffff80003134>] spin_dump+0x62/0x6e

| [<ffffffff800883ba>] do_raw_spin_lock+0xd0/0x142

| [<ffffffff807a6fcc>] _raw_spin_lock_irqsave+0x20/0x2c

| [<ffffffff80536dba>] m_ca

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References