CVE-2021-47668 (GCVE-0-2021-47668)

Vulnerability from cvelistv5 – Published: 2025-04-17 18:01 – Updated: 2026-08-05 08:48
VLAI
Title
can: dev: can_restart: fix use after free bug
Summary
In the Linux kernel, the following vulnerability has been resolved: can: dev: can_restart: fix use after free bug After calling netif_rx_ni(skb), dereferencing skb is unsafe. Especially, the can_frame cf which aliases skb memory is accessed after the netif_rx_ni() in: stats->rx_bytes += cf->len; Reordering the lines solves the issue.
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-17 18:17 UTC
CWE
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 39549eef3587f1c1e8c65c88a2400d10fd30ea17 , < 260925a0b7d2da5449f8ecfd02c1405e0c8a45b8 (git)
Affected: 39549eef3587f1c1e8c65c88a2400d10fd30ea17 , < bbc6847b9b8978b520f62fbc7c68c54ef0f8d282 (git)
Affected: 39549eef3587f1c1e8c65c88a2400d10fd30ea17 , < 92668d28c7e6a7a2ba07df287669ffcdf650c421 (git)
Affected: 39549eef3587f1c1e8c65c88a2400d10fd30ea17 , < 08ab951787098ae0b6c0364aeea7a8138226f234 (git)
Affected: 39549eef3587f1c1e8c65c88a2400d10fd30ea17 , < ac48ef15826e83f4206c47add61072e8fc76d328 (git)
Affected: 39549eef3587f1c1e8c65c88a2400d10fd30ea17 , < 593c072b7b3c4d7044416eb039d9ad706bedd67a (git)
Affected: 39549eef3587f1c1e8c65c88a2400d10fd30ea17 , < 03f16c5075b22c8902d2af739969e878b0879c94 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.31
Unaffected: 0 , < 2.6.31 (semver)
Unaffected: 4.4.254 , ≤ 4.4.* (semver)
Unaffected: 4.9.254 , ≤ 4.9.* (semver)
Unaffected: 4.14.218 , ≤ 4.14.* (semver)
Unaffected: 4.19.171 , ≤ 4.19.* (semver)
Unaffected: 5.4.93 , ≤ 5.4.* (semver)
Unaffected: 5.10.11 , ≤ 5.10.* (semver)
Unaffected: 5.11 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-47668",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-17T18:17:56.944235Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-17T18:25:25.427Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "260925a0b7d2da5449f8ecfd02c1405e0c8a45b8",
              "status": "affected",
              "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
              "versionType": "git"
            },
            {
              "lessThan": "bbc6847b9b8978b520f62fbc7c68c54ef0f8d282",
              "status": "affected",
              "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
              "versionType": "git"
            },
            {
              "lessThan": "92668d28c7e6a7a2ba07df287669ffcdf650c421",
              "status": "affected",
              "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
              "versionType": "git"
            },
            {
              "lessThan": "08ab951787098ae0b6c0364aeea7a8138226f234",
              "status": "affected",
              "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
              "versionType": "git"
            },
            {
              "lessThan": "ac48ef15826e83f4206c47add61072e8fc76d328",
              "status": "affected",
              "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
              "versionType": "git"
            },
            {
              "lessThan": "593c072b7b3c4d7044416eb039d9ad706bedd67a",
              "status": "affected",
              "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
              "versionType": "git"
            },
            {
              "lessThan": "03f16c5075b22c8902d2af739969e878b0879c94",
              "status": "affected",
              "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.31"
            },
            {
              "lessThan": "2.6.31",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.4.*",
              "status": "unaffected",
              "version": "4.4.254",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.254",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.218",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.171",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.4.254",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.254",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.218",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.171",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.93",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.11",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.11",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: dev: can_restart: fix use after free bug\n\nAfter calling netif_rx_ni(skb), dereferencing skb is unsafe.\nEspecially, the can_frame cf which aliases skb memory is accessed\nafter the netif_rx_ni() in:\n      stats-\u003erx_bytes += cf-\u003elen;\n\nReordering the lines solves the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable can_restart path runs after CAN bus-off recovery on real CAN interfaces; an attacker on the same CAN segment can induce bus-off (a known CAN bus-off attack), analogous to Bluetooth/Wi\u2011Fi adjacent reachability rather than internet Network or host-local only.\nAC:L - Bus-off can be reliably forced from the CAN bus, and with automatic recovery (restart-ms) configured\u2014documented and common in automotive/industrial deployments\u2014delayed work deterministically calls can_restart; netif_rx_ni runs softirq and can_receive always frees the skb before cf-\u003elen is read.\nPR:N - An adjacent CAN attacker needs no host account or capabilities; bus-off is triggered by on-bus error conditions and the kernel schedules can_restart when restart-ms is already enabled by the deployment.\nUI:N - No victim user action is required; bus-off and subsequent automatic restart occur from attacker-driven bus errors and kernel workqueue handling alone.\nS:U - This is a kernel-context use-after-free within the same host kernel authority; it does not cross VM, IOMMU, or other security boundaries.\nC:H - Use-after-free of the CAN error skb after netif_rx_ni frees it enables reading reallocated heap contents (cf aliases skb data), which per kernel UAF guidance is High confidentiality impact.\nI:H - Kernel UAF of an sk_buff object is treated as enabling heap reuse and control-flow/corruption primitives, so Integrity is High even though the immediate buggy access is a post-free read into stats.\nA:H - Dereferencing freed skb memory can oops/panic the kernel, and any use-after-free is scored High for availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:48:48.169Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/260925a0b7d2da5449f8ecfd02c1405e0c8a45b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/bbc6847b9b8978b520f62fbc7c68c54ef0f8d282"
        },
        {
          "url": "https://git.kernel.org/stable/c/92668d28c7e6a7a2ba07df287669ffcdf650c421"
        },
        {
          "url": "https://git.kernel.org/stable/c/08ab951787098ae0b6c0364aeea7a8138226f234"
        },
        {
          "url": "https://git.kernel.org/stable/c/ac48ef15826e83f4206c47add61072e8fc76d328"
        },
        {
          "url": "https://git.kernel.org/stable/c/593c072b7b3c4d7044416eb039d9ad706bedd67a"
        },
        {
          "url": "https://git.kernel.org/stable/c/03f16c5075b22c8902d2af739969e878b0879c94"
        }
      ],
      "title": "can: dev: can_restart: fix use after free bug",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47668",
    "datePublished": "2025-04-17T18:01:29.315Z",
    "dateReserved": "2025-04-16T07:16:05.752Z",
    "dateUpdated": "2026-08-05T08:48:48.169Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47668",
      "date": "2026-09-27",
      "epss": "0.00235",
      "percentile": "0.13015"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/can/dev.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "260925a0b7d2da5449f8ecfd02c1405e0c8a45b8",
                    "status": "affected",
                    "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bbc6847b9b8978b520f62fbc7c68c54ef0f8d282",
                    "status": "affected",
                    "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "92668d28c7e6a7a2ba07df287669ffcdf650c421",
                    "status": "affected",
                    "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "08ab951787098ae0b6c0364aeea7a8138226f234",
                    "status": "affected",
                    "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ac48ef15826e83f4206c47add61072e8fc76d328",
                    "status": "affected",
                    "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "593c072b7b3c4d7044416eb039d9ad706bedd67a",
                    "status": "affected",
                    "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "03f16c5075b22c8902d2af739969e878b0879c94",
                    "status": "affected",
                    "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/can/dev.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.31"
                  },
                  {
                    "lessThan": "2.6.31",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.4.*",
                    "status": "unaffected",
                    "version": "4.4.254",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.9.*",
                    "status": "unaffected",
                    "version": "4.9.254",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.14.*",
                    "status": "unaffected",
                    "version": "4.14.218",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.19.*",
                    "status": "unaffected",
                    "version": "4.19.171",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.93",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "5.11",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B3F43128-3AF7-45BD-8292-35295A09235B",
                    "versionEndExcluding": "4.4.254",
                    "versionStartIncluding": "2.6.31",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "828B5BA1-E6D5-4D92-A2FD-7186908DE07C",
                    "versionEndExcluding": "4.9.254",
                    "versionStartIncluding": "4.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "31F3AA41-450C-45A7-A1D3-FB2D8C212890",
                    "versionEndExcluding": "4.14.218",
                    "versionStartIncluding": "4.10",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E048F4A6-F5E6-41BF-BCD6-49274CA46915",
                    "versionEndExcluding": "4.19.171",
                    "versionStartIncluding": "4.15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3F19E9ED-75CE-4576-98F5-2746C9189696",
                    "versionEndExcluding": "5.4.93",
                    "versionStartIncluding": "4.20",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B62A8CB5-77B4-40A9-8B60-AF691EC1FB99",
                    "versionEndExcluding": "5.10.11",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.11:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "18B1C9CE-F7E4-426B-A770-79F86AB5CC38",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.11:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "7A70E596-2EF7-4651-B2EF-2CEE31DB6893",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.11:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "18C82C96-2853-4DFE-93AD-F6E59B4129CA",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.11:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "A330B043-47EA-4D06-82BF-153A1735FC11",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: dev: can_restart: fix use after free bug\n\nAfter calling netif_rx_ni(skb), dereferencing skb is unsafe.\nEspecially, the can_frame cf which aliases skb memory is accessed\nafter the netif_rx_ni() in:\n      stats-\u003erx_bytes += cf-\u003elen;\n\nReordering the lines solves the issue."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: can: dev: can_restart: fix use after free bug. Tras llamar a netif_rx_ni(skb), desreferenciar skb no es seguro. En particular, se accede al cf can_frame, que crea un alias de memoria skb, despu\u00e9s de netif_rx_ni() en: stats-\u0026gt;rx_bytes += cf-\u0026gt;len;. Reordenar las l\u00edneas soluciona el problema."
          }
        ],
        "id": "CVE-2021-47668",
        "lastModified": "2026-08-04T10:17:12.543",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2021-47668",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-17T18:17:56.944235Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-04-17T18:15:43.623",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/03f16c5075b22c8902d2af739969e878b0879c94"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/08ab951787098ae0b6c0364aeea7a8138226f234"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/260925a0b7d2da5449f8ecfd02c1405e0c8a45b8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/593c072b7b3c4d7044416eb039d9ad706bedd67a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/92668d28c7e6a7a2ba07df287669ffcdf650c421"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ac48ef15826e83f4206c47add61072e8fc76d328"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/bbc6847b9b8978b520f62fbc7c68c54ef0f8d282"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T22:47:51+00:00",
      "cve": "CVE-2021-47668",
      "id": "CVE-2021-47668",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_affected": "90",
      "product_status:known_not_affected": "184",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: can: dev: can_restart: fix use after free bug",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47668.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-02T02:16:29Z",
      "cve": "CVE-2021-47668",
      "id": "CVE-2021-47668",
      "initial_release_date": "2025-04-18T01:48:45Z",
      "product_status:known_affected": "521",
      "product_status:known_not_affected": "270",
      "product_status:recommended": "122",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47668",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47668.json",
      "version": "32"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "HIGH",
                  "baseScore": 7.8,
                  "baseSeverity": "HIGH",
                  "confidentialityImpact": "HIGH",
                  "integrityImpact": "HIGH",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2021-47668",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-04-17T18:17:56.944235Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-416",
                    "description": "CWE-416 Use After Free",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-04-17T18:17:58.458Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/net/can/dev.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "260925a0b7d2da5449f8ecfd02c1405e0c8a45b8",
                  "status": "affected",
                  "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
                  "versionType": "git"
                },
                {
                  "lessThan": "bbc6847b9b8978b520f62fbc7c68c54ef0f8d282",
                  "status": "affected",
                  "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
                  "versionType": "git"
                },
                {
                  "lessThan": "92668d28c7e6a7a2ba07df287669ffcdf650c421",
                  "status": "affected",
                  "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
                  "versionType": "git"
                },
                {
                  "lessThan": "08ab951787098ae0b6c0364aeea7a8138226f234",
                  "status": "affected",
                  "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
                  "versionType": "git"
                },
                {
                  "lessThan": "ac48ef15826e83f4206c47add61072e8fc76d328",
                  "status": "affected",
                  "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
                  "versionType": "git"
                },
                {
                  "lessThan": "593c072b7b3c4d7044416eb039d9ad706bedd67a",
                  "status": "affected",
                  "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
                  "versionType": "git"
                },
                {
                  "lessThan": "03f16c5075b22c8902d2af739969e878b0879c94",
                  "status": "affected",
                  "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/net/can/dev.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "2.6.31"
                },
                {
                  "lessThan": "2.6.31",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.4.*",
                  "status": "unaffected",
                  "version": "4.4.254",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.9.*",
                  "status": "unaffected",
                  "version": "4.9.254",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.14.*",
                  "status": "unaffected",
                  "version": "4.14.218",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.19.*",
                  "status": "unaffected",
                  "version": "4.19.171",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.4.*",
                  "status": "unaffected",
                  "version": "5.4.93",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.11",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "5.11",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.4.254",
                      "versionStartIncluding": "2.6.31",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.9.254",
                      "versionStartIncluding": "2.6.31",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.14.218",
                      "versionStartIncluding": "2.6.31",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.19.171",
                      "versionStartIncluding": "2.6.31",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.4.93",
                      "versionStartIncluding": "2.6.31",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.11",
                      "versionStartIncluding": "2.6.31",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.11",
                      "versionStartIncluding": "2.6.31",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: dev: can_restart: fix use after free bug\n\nAfter calling netif_rx_ni(skb), dereferencing skb is unsafe.\nEspecially, the can_frame cf which aliases skb memory is accessed\nafter the netif_rx_ni() in:\n      stats-\u003erx_bytes += cf-\u003elen;\n\nReordering the lines solves the issue."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:A - The vulnerable can_restart path runs after CAN bus-off recovery on real CAN interfaces; an attacker on the same CAN segment can induce bus-off (a known CAN bus-off attack), analogous to Bluetooth/Wi\u2011Fi adjacent reachability rather than internet Network or host-local only.\nAC:L - Bus-off can be reliably forced from the CAN bus, and with automatic recovery (restart-ms) configured\u2014documented and common in automotive/industrial deployments\u2014delayed work deterministically calls can_restart; netif_rx_ni runs softirq and can_receive always frees the skb before cf-\u003elen is read.\nPR:N - An adjacent CAN attacker needs no host account or capabilities; bus-off is triggered by on-bus error conditions and the kernel schedules can_restart when restart-ms is already enabled by the deployment.\nUI:N - No victim user action is required; bus-off and subsequent automatic restart occur from attacker-driven bus errors and kernel workqueue handling alone.\nS:U - This is a kernel-context use-after-free within the same host kernel authority; it does not cross VM, IOMMU, or other security boundaries.\nC:H - Use-after-free of the CAN error skb after netif_rx_ni frees it enables reading reallocated heap contents (cf aliases skb data), which per kernel UAF guidance is High confidentiality impact.\nI:H - Kernel UAF of an sk_buff object is treated as enabling heap reuse and control-flow/corruption primitives, so Integrity is High even though the immediate buggy access is a post-free read into stats.\nA:H - Dereferencing freed skb memory can oops/panic the kernel, and any use-after-free is scored High for availability."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T08:48:48.169Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/260925a0b7d2da5449f8ecfd02c1405e0c8a45b8"
            },
            {
              "url": "https://git.kernel.org/stable/c/bbc6847b9b8978b520f62fbc7c68c54ef0f8d282"
            },
            {
              "url": "https://git.kernel.org/stable/c/92668d28c7e6a7a2ba07df287669ffcdf650c421"
            },
            {
              "url": "https://git.kernel.org/stable/c/08ab951787098ae0b6c0364aeea7a8138226f234"
            },
            {
              "url": "https://git.kernel.org/stable/c/ac48ef15826e83f4206c47add61072e8fc76d328"
            },
            {
              "url": "https://git.kernel.org/stable/c/593c072b7b3c4d7044416eb039d9ad706bedd67a"
            },
            {
              "url": "https://git.kernel.org/stable/c/03f16c5075b22c8902d2af739969e878b0879c94"
            }
          ],
          "title": "can: dev: can_restart: fix use after free bug",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2021-47668",
        "datePublished": "2025-04-17T18:01:29.315Z",
        "dateReserved": "2025-04-16T07:16:05.752Z",
        "dateUpdated": "2026-08-05T08:48:48.169Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Loading…

Loading…

Loading…

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.


Loading…