Skip to main content

Linux Kernel CVE-2021-47670

HIGH
Use After Free (CWE-416)
2025-04-17 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Denial Of Service Linux Use After Free Memory Corruption
8.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
8.8 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
8.8 HIGH

CAN bus adjacency (AV:A) is the hard prerequisite; once on the bus, no OS privileges or user interaction are needed to send triggering frames.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Updated
Aug 04, 2026 - 10:37 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Aug 04, 2026 - 10:23 vuln.today
cvss_changed
CVSS changed
Aug 04, 2026 - 10:23 NVD
7.8 (HIGH) 8.8 (HIGH)
Analysis Generated
Mar 28, 2026 - 18:37 vuln.today
Patch released
Mar 28, 2026 - 18:37 nvd
Patch available
CVE Published
Apr 17, 2025 - 18:15 nvd
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

can: peak_usb: fix use after free bugs

After calling peak_usb_netif_rx_ni(skb), dereferencing skb is unsafe. Especially, the can_frame cf which aliases skb memory is accessed after the peak_usb_netif_rx_ni().

Reordering the lines solves the issue.

AnalysisAI

Use-after-free memory corruption in the Linux kernel's PEAK USB CAN bus driver (peak_usb) exposes systems with PEAK System USB adapters to kernel memory corruption when processing incoming CAN frames from an adjacent network. The flaw stems from incorrect operation ordering: peak_usb_netif_rx_ni(skb) transfers skb ownership to the network stack before the driver finishes accessing the can_frame alias cf, which points into the now-freed skb memory. No public exploit has been identified and EPSS is extremely low (0.07%, 21st percentile), but multiple vendor patch trains from Red Hat and SUSE confirm the issue reached production systems and warranted backported fixes.

Technical ContextAI

The vulnerability lives in the Linux kernel CAN subsystem's peak_usb driver, which supports PEAK System USB-to-CAN bus adapters. The root cause is CWE-416 (Use After Free): sk_buff (skb) is a kernel socket buffer structure whose data pointer is aliased by the local can_frame pointer cf. When peak_usb_netif_rx_ni(skb) is called, ownership of skb is passed to the network stack, which is free to recycle or free the underlying memory immediately. Any subsequent dereference of cf (or skb itself) operates on potentially reclaimed memory, enabling heap corruption. The fix reorders these operations so all cf/skb reads complete before the rx_ni handoff. CPE data confirms the affected product is linux:linux_kernel across stable release branches as well as 5.11-rc1 through 5.11-rc4 pre-release candidates.

RemediationAI

Apply the upstream kernel fix available via four stable-tree commits: 50aca891d7a554db0901b245167cd653d73aaa71, 5408824636fa0dfedb9ecb0d94abd573131bfbbe, ddd1416f44130377798c1430b76503513b7497c2, and ec939c13c3fff2114479769c8380b7f1a54feca9 (all at git.kernel.org/stable). Red Hat Enterprise Linux users should apply the packages from RHSA-2025:13590 and related advisories at access.redhat.com/errata. SUSE users should apply SUSE-SU-2025:01633 and associated updates. Where immediate patching is not possible, the most effective compensating control is to unload and blacklist the peak_usb module: run 'modprobe -r peak_usb' and add 'blacklist peak_usb' to /etc/modprobe.d/blacklist.conf. This eliminates the attack surface entirely with the trade-off that PEAK USB CAN devices will be non-functional until the patch is applied. No other compensating control short of hardware removal provides equivalent protection, as the vulnerability is triggered by normal CAN frame receipt.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container suse/sle-micro-rancher/5.2:latest Image SLES15-SP3-Micro-5-2-BYOS-Azure Image SLES15-SP3-Micro-5-2-BYOS-EC2-HVM Image SLES15-SP3-Micro-5-2-BYOS-GCE Affected
Image SLES12-SP5-Azure-BYOS Image SLES12-SP5-Azure-HPC-BYOS Image SLES12-SP5-EC2-BYOS Image SLES12-SP5-EC2-ECS-On-Demand Image SLES12-SP5-EC2-On-Demand Image SLES12-SP5-GCE-BYOS Image SLES12-SP5-GCE-On-Demand Affected
Image SLES12-SP5-Azure-SAP-BYOS Image SLES12-SP5-Azure-SAP-On-Demand Image SLES12-SP5-EC2-SAP-BYOS Image SLES12-SP5-EC2-SAP-On-Demand Image SLES12-SP5-GCE-SAP-BYOS Image SLES12-SP5-GCE-SAP-On-Demand Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production Affected
Image SLES15-SP3-SAP-Azure-LI-BYOS-Production Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production Affected
SUSE Enterprise Storage 7.1 Fixed

Share

CVE-2021-47670 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy