Skip to main content

Linux Kernel CVE-2021-47668

HIGH
Use After Free (CWE-416)
2025-04-17 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Denial Of Service Linux Use After Free Memory Corruption
8.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
8.8 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.4 MEDIUM

AV:A for mandatory CAN bus adjacency; AC:H because bus-off triggering requires sustained error injection; C:L/I:L not H given a stats-path UAF read rather than a reliable write or data-exfil primitive; A:H for likely kernel panic.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
4.0 AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Updated
Aug 04, 2026 - 10:39 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Aug 04, 2026 - 10:23 vuln.today
cvss_changed
CVSS changed
Aug 04, 2026 - 10:23 NVD
7.8 (HIGH) 8.8 (HIGH)
Analysis Generated
Mar 28, 2026 - 18:37 vuln.today
Patch released
Mar 28, 2026 - 18:37 nvd
Patch available
CVE Published
Apr 17, 2025 - 18:15 nvd
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

can: dev: can_restart: fix use after free bug

After calling netif_rx_ni(skb), dereferencing skb is unsafe. Especially, the can_frame cf which aliases skb memory is accessed after the netif_rx_ni() in: stats->rx_bytes += cf->len;

Reordering the lines solves the issue.

AnalysisAI

Use-after-free memory corruption in the Linux kernel CAN subsystem's can_restart() function allows an attacker with adjacent CAN bus access to trigger kernel memory corruption via a post-free dereference of socket buffer memory. Affected are Linux kernel versions across multiple stable branches through 5.11-rc4, confirmed by seven upstream patch commits and three SUSE enterprise security advisories issued in May 2025. No active exploitation has been confirmed - the vulnerability is absent from CISA KEV, EPSS is 0.06% (20th percentile), and no public POC is known - making this primarily a kernel stability risk rather than an active threat.

Technical ContextAI

The vulnerability resides in the CAN (Controller Area Network) subsystem driver core within the can_restart() function, which executes on a deferred workqueue when a CAN interface recovers from a bus-off condition. During restart, the function allocates a socket buffer (skb), constructs a CAN error frame using a can_frame pointer cf that aliases the skb's data region, and then transfers ownership of the skb to the network stack via netif_rx_ni(skb). This call may immediately free or reassign the skb's memory; however, the code subsequently reads cf->len to update receive byte statistics (stats->rx_bytes += cf->len), constituting a CWE-416 use-after-free. CPE data identifies the vulnerable component as cpe:2.3:o:linux:linux_kernel:* across multiple stable branches, explicitly including 5.11-rc1 through 5.11-rc4. The fix is a trivial line reorder: capture cf->len before calling netif_rx_ni(), eliminating the post-transfer dereference.

RemediationAI

Apply the upstream kernel patches backported to multiple stable branches via commits 03f16c507, 08ab95178, 260925a0b, 593c072b7, 92668d28c, ac48ef158, and bbc6847b9 (full URLs available at https://git.kernel.org/stable/). SUSE enterprise users should apply SUSE-SU-2025:01600, SUSE-SU-2025:01633, or SUSE-SU-2025:1574 as appropriate for their distribution release. Exact fixed upstream kernel release version numbers were not independently confirmed from available data - consult your Linux distribution's errata or kernel changelog for specific patched package versions. As a compensating control where immediate patching is not feasible, unloading CAN kernel modules (rmmod can_dev; rmmod can) will prevent the vulnerable code path from executing, at the cost of disabling all CAN interface functionality. Restricting physical access to CAN bus interfaces (e.g., OBD-II ports, industrial fieldbus connectors) and segmenting CAN networks reduces the adjacent-network attack surface.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container suse/sle-micro-rancher/5.2:latest Image SLES15-SP3-Micro-5-2-BYOS-Azure Image SLES15-SP3-Micro-5-2-BYOS-EC2-HVM Image SLES15-SP3-Micro-5-2-BYOS-GCE Affected
Image SLES12-SP5-Azure-BYOS Image SLES12-SP5-Azure-HPC-BYOS Image SLES12-SP5-EC2-BYOS Image SLES12-SP5-EC2-ECS-On-Demand Image SLES12-SP5-EC2-On-Demand Image SLES12-SP5-GCE-BYOS Image SLES12-SP5-GCE-On-Demand Affected
Image SLES12-SP5-Azure-SAP-BYOS Image SLES12-SP5-Azure-SAP-On-Demand Image SLES12-SP5-EC2-SAP-BYOS Image SLES12-SP5-EC2-SAP-On-Demand Image SLES12-SP5-GCE-SAP-BYOS Image SLES12-SP5-GCE-SAP-On-Demand Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production Affected
Image SLES15-SP3-SAP-Azure-LI-BYOS-Production Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production Affected
SUSE Enterprise Storage 7.1 Fixed

Share

CVE-2021-47668 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy