CVE-2021-47670

can: peak_usb: fix use after free bugs

State: Published
Severity: 8.8 High
Published: Apr 17, 2025
Updated: Aug 5, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

can: peak_usb: fix use after free bugs

After calling peak_usb_netif_rx_ni(skb), dereferencing skb is unsafe. Especially, the can_frame cf which aliases skb memory is accessed after the peak_usb_netif_rx_ni().

Reordering the lines solves the issue.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	0a25e1f4f18566b750ebd3ae995af64e23111e63 to before 5408824636fa0dfedb9ecb0d94abd573131bfbbeAffected 0a25e1f4f18566b750ebd3ae995af64e23111e63 to before ddd1416f44130377798c1430b76503513b7497c2Affected 0a25e1f4f18566b750ebd3ae995af64e23111e63 to before ec939c13c3fff2114479769c8380b7f1a54feca9Affected 0a25e1f4f18566b750ebd3ae995af64e23111e63 to before 50aca891d7a554db0901b245167cd653d73aaa71Affected
LinuxLinux	4.0Affected before 4.0Not affected 4.19.171 through 4.19.Not affected 5.4.93 through 5.4.Not affected 5.10.11 through 5.10.*Not affected 5.11 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.