Riskcovery

CVE-2021-47519

can: m_can: m_can_read_fifo: fix memory leak in error branch

State
Published
Severity
7.5 High
Published
May 24, 2024
Updated
May 11, 2026
Reserved
May 24, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

can: m_can: m_can_read_fifo: fix memory leak in error branch

In m_can_read_fifo(), if the second call to m_can_fifo_read() fails, the function jump to the out_fail label and returns without calling m_can_receive_skb(). This means that the skb previously allocated by alloc_can_skb() is not freed. In other terms, this is a memory leak.

This patch adds a goto label to destroy the skb if an error occurs.

Issue was found with GCC -fanalyzer, please follow the link below for details.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCISA-ADP

Weaknesses

  • CWE-401 Missing Release of Memory after Effective Lifetime

Affected Products

ProductVersions
LinuxLinux
  • e39381770ec9ca3c51d8b9bd9cc6e01d78ea974a to before 75a422165477dd12d2d20aa7c9ee7c9a281c9908Affected
  • e39381770ec9ca3c51d8b9bd9cc6e01d78ea974a to before 31cb32a590d62b18f69a9a6d433f4e69c74fdd56Affected
LinuxLinux
  • 5.15Affected
  • before 5.15Not affected
  • 5.15.8 through 5.15.*Not affected
  • 5.16 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.