High · published April 17, 2025
In the Linux kernel, the following vulnerability has been resolved:
can: dev: can_restart: fix use after free bug
After calling netif_rx_ni(skb), dereferencing skb is unsafe.
Especially, the can_frame cf which aliases skb memory is accessed
after the netif_rx_ni() in:
stats->rx_bytes += cf->len;
Reordering the lines solves the issue.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 2.6.31, < 4.4.254 | 4.4.254 |
| linux/linux_kernel | ≥ 4.5, < 4.9.254 | 4.9.254 |
| linux/linux_kernel | ≥ 4.10, < 4.14.218 | 4.14.218 |
| linux/linux_kernel | ≥ 4.15, < 4.19.171 | 4.19.171 |
| linux/linux_kernel | ≥ 4.20, < 5.4.93 | 5.4.93 |
| linux/linux_kernel | ≥ 5.5, < 5.10.11 | 5.10.11 |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |