CVE-2021-47668

can: dev: can_restart: fix use after free bug

State: Published
Severity: 8.8 High
Published: Apr 17, 2025
Updated: Aug 5, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

can: dev: can_restart: fix use after free bug

After calling netif_rx_ni(skb), dereferencing skb is unsafe. Especially, the can_frame cf which aliases skb memory is accessed after the netif_rx_ni() in: stats->rx_bytes += cf->len;

Reordering the lines solves the issue.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	39549eef3587f1c1e8c65c88a2400d10fd30ea17 to before 260925a0b7d2da5449f8ecfd02c1405e0c8a45b8Affected 39549eef3587f1c1e8c65c88a2400d10fd30ea17 to before bbc6847b9b8978b520f62fbc7c68c54ef0f8d282Affected 39549eef3587f1c1e8c65c88a2400d10fd30ea17 to before 92668d28c7e6a7a2ba07df287669ffcdf650c421Affected 39549eef3587f1c1e8c65c88a2400d10fd30ea17 to before 08ab951787098ae0b6c0364aeea7a8138226f234Affected 39549eef3587f1c1e8c65c88a2400d10fd30ea17 to before ac48ef15826e83f4206c47add61072e8fc76d328Affected 39549eef3587f1c1e8c65c88a2400d10fd30ea17 to before 593c072b7b3c4d7044416eb039d9ad706bedd67aAffected 39549eef3587f1c1e8c65c88a2400d10fd30ea17 to before 03f16c5075b22c8902d2af739969e878b0879c94Affected
LinuxLinux	2.6.31Affected before 2.6.31Not affected 4.4.254 through 4.4.Not affected 4.9.254 through 4.9.Not affected 4.14.218 through 4.14.Not affected 4.19.171 through 4.19.Not affected 5.4.93 through 5.4.Not affected 5.10.11 through 5.10.Not affected 5.11 and laterNot affected

Product

Versions

LinuxLinux

39549eef3587f1c1e8c65c88a2400d10fd30ea17 to before 260925a0b7d2da5449f8ecfd02c1405e0c8a45b8Affected
39549eef3587f1c1e8c65c88a2400d10fd30ea17 to before bbc6847b9b8978b520f62fbc7c68c54ef0f8d282Affected
39549eef3587f1c1e8c65c88a2400d10fd30ea17 to before 92668d28c7e6a7a2ba07df287669ffcdf650c421Affected
39549eef3587f1c1e8c65c88a2400d10fd30ea17 to before 08ab951787098ae0b6c0364aeea7a8138226f234Affected
39549eef3587f1c1e8c65c88a2400d10fd30ea17 to before ac48ef15826e83f4206c47add61072e8fc76d328Affected
39549eef3587f1c1e8c65c88a2400d10fd30ea17 to before 593c072b7b3c4d7044416eb039d9ad706bedd67aAffected
39549eef3587f1c1e8c65c88a2400d10fd30ea17 to before 03f16c5075b22c8902d2af739969e878b0879c94Affected

LinuxLinux

2.6.31Affected
before 2.6.31Not affected
4.4.254 through 4.4.*Not affected
4.9.254 through 4.9.*Not affected
4.14.218 through 4.14.*Not affected
4.19.171 through 4.19.*Not affected
5.4.93 through 5.4.*Not affected
5.10.11 through 5.10.*Not affected
5.11 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.