CVE-2021-47520

can: pch_can: pch_can_rx_normal: fix use after free

State: Published
Severity: 8.8 High
Published: May 24, 2024
Updated: Aug 5, 2026
Reserved: May 24, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

can: pch_can: pch_can_rx_normal: fix use after free

After calling netif_receive_skb(skb), dereferencing skb is unsafe. Especially, the can_frame cf which aliases skb memory is dereferenced just after the call netif_receive_skb(skb).

Reordering the lines solves the issue.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	b21d18b51b31a24d17f883b678432fbdee3d5675 to before bafe343a885c70dddf358379cf0b2a1c07355d8dAffected b21d18b51b31a24d17f883b678432fbdee3d5675 to before 3a3c46e2eff0577454860a203be1a8295f4acb76Affected b21d18b51b31a24d17f883b678432fbdee3d5675 to before affbad02bf80380a7403885b9fe4a1587d1bb4f3Affected b21d18b51b31a24d17f883b678432fbdee3d5675 to before 3e193ef4e0a3f5bf92ede83ef214cb09d01b00aaAffected b21d18b51b31a24d17f883b678432fbdee3d5675 to before abb4eff3dcd2e583060082a18a8dbf31f02689d4Affected b21d18b51b31a24d17f883b678432fbdee3d5675 to before 703dde112021c93d6e89443c070e7dbd4dea612eAffected b21d18b51b31a24d17f883b678432fbdee3d5675 to before 6c73fc931658d8cbc8a1714b326cb31eb71d16a7Affected b21d18b51b31a24d17f883b678432fbdee3d5675 to before 94cddf1e9227a171b27292509d59691819c458dbAffected
LinuxLinux	2.6.37Affected before 2.6.37Not affected 4.4.295 through 4.4.Not affected 4.9.293 through 4.9.Not affected 4.14.258 through 4.14.Not affected 4.19.221 through 4.19.Not affected 5.4.165 through 5.4.Not affected 5.10.85 through 5.10.Not affected 5.15.8 through 5.15.*Not affected 5.16 and laterNot affected

Product

Versions

LinuxLinux

b21d18b51b31a24d17f883b678432fbdee3d5675 to before bafe343a885c70dddf358379cf0b2a1c07355d8dAffected
b21d18b51b31a24d17f883b678432fbdee3d5675 to before 3a3c46e2eff0577454860a203be1a8295f4acb76Affected
b21d18b51b31a24d17f883b678432fbdee3d5675 to before affbad02bf80380a7403885b9fe4a1587d1bb4f3Affected
b21d18b51b31a24d17f883b678432fbdee3d5675 to before 3e193ef4e0a3f5bf92ede83ef214cb09d01b00aaAffected
b21d18b51b31a24d17f883b678432fbdee3d5675 to before abb4eff3dcd2e583060082a18a8dbf31f02689d4Affected
b21d18b51b31a24d17f883b678432fbdee3d5675 to before 703dde112021c93d6e89443c070e7dbd4dea612eAffected
b21d18b51b31a24d17f883b678432fbdee3d5675 to before 6c73fc931658d8cbc8a1714b326cb31eb71d16a7Affected
b21d18b51b31a24d17f883b678432fbdee3d5675 to before 94cddf1e9227a171b27292509d59691819c458dbAffected

LinuxLinux

2.6.37Affected
before 2.6.37Not affected
4.4.295 through 4.4.*Not affected
4.9.293 through 4.9.*Not affected
4.14.258 through 4.14.*Not affected
4.19.221 through 4.19.*Not affected
5.4.165 through 5.4.*Not affected
5.10.85 through 5.10.*Not affected
5.15.8 through 5.15.*Not affected
5.16 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.