CVE-2022-49275

can: m_can: m_can_tx_handler(): fix use after free of skb

State: Published
Severity: 7.8 High
Published: Feb 26, 2025
Updated: Aug 5, 2026
Reserved: Feb 26, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

can: m_can: m_can_tx_handler(): fix use after free of skb

can_put_echo_skb() will clone skb then free the skb. Move the can_put_echo_skb() for the m_can version 3.0.x directly before the start of the xmit in hardware, similar to the 3.1.x branch.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	80646733f11c2e9de3b6339f7e635047e6087280 to before d93ed9aff64968f4cdad690712eb4f48ae537bdeAffected 80646733f11c2e9de3b6339f7e635047e6087280 to before d3892a747ab16b1eb6593a19d29f62c3b3f020acAffected 80646733f11c2e9de3b6339f7e635047e6087280 to before 7728d937ec403a1ceff9483023252d2cb8777f81Affected 80646733f11c2e9de3b6339f7e635047e6087280 to before 08d90846e438ac22dc56fc49ec0b0d195831c5edAffected 80646733f11c2e9de3b6339f7e635047e6087280 to before 869016a2938ac44f7b2fb7fc22c89edad99eb9b3Affected 80646733f11c2e9de3b6339f7e635047e6087280 to before f43e64076ff1b1dcb893fb77ad1204105f710a29Affected 80646733f11c2e9de3b6339f7e635047e6087280 to before 4db7d6f481990dd179a9ee7126dc7aa31ea4fff3Affected 80646733f11c2e9de3b6339f7e635047e6087280 to before 31417073493f302d26ab66b3abc098d43227b835Affected 80646733f11c2e9de3b6339f7e635047e6087280 to before 2e8e79c416aae1de224c0f1860f2e3350fa171f8Affected
LinuxLinux	3.18Affected before 3.18Not affected 4.9.324 through 4.9.Not affected 4.14.289 through 4.14.Not affected 4.19.253 through 4.19.Not affected 5.4.207 through 5.4.Not affected 5.10.110 through 5.10.Not affected 5.15.33 through 5.15.Not affected 5.16.19 through 5.16.Not affected 5.17.2 through 5.17.Not affected 5.18 and laterNot affected

Product

Versions

LinuxLinux

80646733f11c2e9de3b6339f7e635047e6087280 to before d93ed9aff64968f4cdad690712eb4f48ae537bdeAffected
80646733f11c2e9de3b6339f7e635047e6087280 to before d3892a747ab16b1eb6593a19d29f62c3b3f020acAffected
80646733f11c2e9de3b6339f7e635047e6087280 to before 7728d937ec403a1ceff9483023252d2cb8777f81Affected
80646733f11c2e9de3b6339f7e635047e6087280 to before 08d90846e438ac22dc56fc49ec0b0d195831c5edAffected
80646733f11c2e9de3b6339f7e635047e6087280 to before 869016a2938ac44f7b2fb7fc22c89edad99eb9b3Affected
80646733f11c2e9de3b6339f7e635047e6087280 to before f43e64076ff1b1dcb893fb77ad1204105f710a29Affected
80646733f11c2e9de3b6339f7e635047e6087280 to before 4db7d6f481990dd179a9ee7126dc7aa31ea4fff3Affected
80646733f11c2e9de3b6339f7e635047e6087280 to before 31417073493f302d26ab66b3abc098d43227b835Affected
80646733f11c2e9de3b6339f7e635047e6087280 to before 2e8e79c416aae1de224c0f1860f2e3350fa171f8Affected

LinuxLinux

3.18Affected
before 3.18Not affected
4.9.324 through 4.9.*Not affected
4.14.289 through 4.14.*Not affected
4.19.253 through 4.19.*Not affected
5.4.207 through 5.4.*Not affected
5.10.110 through 5.10.*Not affected
5.15.33 through 5.15.*Not affected
5.16.19 through 5.16.*Not affected
5.17.2 through 5.17.*Not affected
5.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.