The vulnerability in the Linux kernel's can: etas_es58x driver arises because the driver did not implement the net_device_ops->ndo_change_mtu() callback. This omission allowed an attacker to configure an invalid MTU (e.g., 9999) on the CAN interface. Subsequently, by opening a PF_PACKET socket with the ETH_P_CANXL protocol, the attacker could inject CAN XL frames with crafted flags and length fields. The es58x_start_xmit() function misinterprets these frames as CAN(FD) frames and copies data without proper length validation, causing a buffer overflow of up to 247 bytes. The root cause was fixed by populating ndo_change_mtu() to restrict MTU settings to valid CAN or CANFD MTU sizes, preventing the overflow.

Successful exploitation allows a local attacker to cause a buffer overflow in the CAN driver, potentially leading to memory corruption with high impact on confidentiality, integrity, and availability of the system. This could result in arbitrary code execution or system crashes.

A fix is available that populates the net_device_ops->ndo_change_mtu() callback in the etas_es58x driver to restrict MTU values to valid ranges. Users should apply the official Linux kernel updates that include this patch. Since this is a kernel vulnerability, upgrading to a fixed kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; check the vendor or Linux kernel advisories for the exact fixed versions and apply updates accordingly.