[bug report] Potential order bug in 'drivers/net/can/vxcan.c', primarily in 'vxcan_dellink()'
From: Ginger
Date: Fri Apr 24 2026 - 11:24:43 EST
Dear Linux kernel maintainers,
My research-based static analyzer found a potential order bug within
the ' drivers/net/can' subsystem, more specifically, in '
drivers/net/can/vxcan.c'.
Kernel version: long-term kernel v6.18.9
Potential issue:
T0:
vxcan_dellink
--> RCU_INIT_POINTER(priv->peer, NULL);
--> unregister_netdevice_queue(dev, head);
In T0, the priv->peer field is nullified before the device is
unregistered from the kernel in 'unregister_netdevice_queue()'.
Considering that many other kernel functions rely on the existence of
the netdev and dereferences 'priv->peer', e.g., vxcan_open() and
vxcan_xmit(), it is possible to cause null pointer deref in concurrent
executions.
Thank you for your time and consideration.
Sincerely,
Ginger