CVE-2025-39873 (GCVE-0-2025-39873)

Vulnerability from cvelistv5 – Published: 2025-09-23 06:00 – Updated: 2026-08-05 12:05
VLAI
Title
can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB
Summary
In the Linux kernel, the following vulnerability has been resolved: can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB can_put_echo_skb() takes ownership of the SKB and it may be freed during or after the call. However, xilinx_can xcan_write_frame() keeps using SKB after the call. Fix that by only calling can_put_echo_skb() after the code is done touching the SKB. The tx_lock is held for the entire xcan_write_frame() execution and also on the can_get_echo_skb() side so the order of operations does not matter. An earlier fix commit 3d3c817c3a40 ("can: xilinx_can: Fix usage of skb memory") did not move the can_put_echo_skb() call far enough. [mkl: add "commit" in front of sha1 in patch description] [mkl: fix indention]
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 1598efe57b3e768056e4ca56cb9cf33111e68d1c , < e202ffd9e54538ef67ec301ebd6d9da4823466c9 (git)
Affected: 1598efe57b3e768056e4ca56cb9cf33111e68d1c , < 1139321161a3ba5e45e61e0738b37f42f20bc57a (git)
Affected: 1598efe57b3e768056e4ca56cb9cf33111e68d1c , < 94b050726288a56a6b8ff55aa641f2fedbd3b44c (git)
Affected: 1598efe57b3e768056e4ca56cb9cf33111e68d1c , < 725b33deebd6e4c96fe7893f384510a54258f28f (git)
Affected: 1598efe57b3e768056e4ca56cb9cf33111e68d1c , < 668cc1e3bb21101d074e430de1b7ba8fd10189e7 (git)
Affected: 1598efe57b3e768056e4ca56cb9cf33111e68d1c , < ef79f00be72bd81d2e1e6f060d83cf7e425deee4 (git)
Create a notification for this product.
Linux Linux Affected: 4.19
Unaffected: 0 , < 4.19 (semver)
Unaffected: 5.15.194 , ≤ 5.15.* (semver)
Unaffected: 6.1.153 , ≤ 6.1.* (semver)
Unaffected: 6.6.107 , ≤ 6.6.* (semver)
Unaffected: 6.12.48 , ≤ 6.12.* (semver)
Unaffected: 6.16.8 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:44:20.103Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/xilinx_can.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e202ffd9e54538ef67ec301ebd6d9da4823466c9",
              "status": "affected",
              "version": "1598efe57b3e768056e4ca56cb9cf33111e68d1c",
              "versionType": "git"
            },
            {
              "lessThan": "1139321161a3ba5e45e61e0738b37f42f20bc57a",
              "status": "affected",
              "version": "1598efe57b3e768056e4ca56cb9cf33111e68d1c",
              "versionType": "git"
            },
            {
              "lessThan": "94b050726288a56a6b8ff55aa641f2fedbd3b44c",
              "status": "affected",
              "version": "1598efe57b3e768056e4ca56cb9cf33111e68d1c",
              "versionType": "git"
            },
            {
              "lessThan": "725b33deebd6e4c96fe7893f384510a54258f28f",
              "status": "affected",
              "version": "1598efe57b3e768056e4ca56cb9cf33111e68d1c",
              "versionType": "git"
            },
            {
              "lessThan": "668cc1e3bb21101d074e430de1b7ba8fd10189e7",
              "status": "affected",
              "version": "1598efe57b3e768056e4ca56cb9cf33111e68d1c",
              "versionType": "git"
            },
            {
              "lessThan": "ef79f00be72bd81d2e1e6f060d83cf7e425deee4",
              "status": "affected",
              "version": "1598efe57b3e768056e4ca56cb9cf33111e68d1c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/xilinx_can.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "lessThan": "4.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.194",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.107",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.48",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.194",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.153",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.107",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.48",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.8",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB\n\ncan_put_echo_skb() takes ownership of the SKB and it may be freed\nduring or after the call.\n\nHowever, xilinx_can xcan_write_frame() keeps using SKB after the call.\n\nFix that by only calling can_put_echo_skb() after the code is done\ntouching the SKB.\n\nThe tx_lock is held for the entire xcan_write_frame() execution and\nalso on the can_get_echo_skb() side so the order of operations does not\nmatter.\n\nAn earlier fix commit 3d3c817c3a40 (\"can: xilinx_can: Fix usage of skb\nmemory\") did not move the can_put_echo_skb() call far enough.\n\n[mkl: add \"commit\" in front of sha1 in patch description]\n[mkl: fix indention]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is only reached from `ndo_start_xmit` on the xilinx_can device, i.e. by a local process transmitting a frame through a `PF_CAN` socket (`sendmsg()`); received bus traffic does not enter this path. Exploitation therefore requires local system access.\nAC:L - The attacker drives both the transmission and the conditions that make `can_put_echo_skb()` free the SKB (TX flooding to saturate the FIFO/echo slots, memory pressure to fail the `GFP_ATOMIC` `skb_clone`), and can retry indefinitely at line rate; the free is not a race the attacker cannot influence.\nPR:L - `can_create()` in net/can/af_can.c and the CAN_RAW protocol perform no capability check, so any unprivileged local user can open a raw CAN socket, bind it to the interface and transmit. No root or CAP_NET_ADMIN is needed to reach `xcan_write_frame()`.\nUI:N - The attacker\u0027s own `sendmsg()` call drives the whole path; no victim action or cooperation is required.\nS:U - The corruption stays within the kernel\u0027s own security authority \u2014 freed kernel heap and the driver\u0027s MMIO window \u2014 with no crossing of a hypervisor, IOMMU or sandbox boundary.\nC:H - The UAF reads freed (and, with a groomed `cf-\u003elen`, out-of-bounds) kernel heap contents and writes them into the CAN controller\u0027s TX registers, which are then transmitted on the physical CAN bus where any node \u2014 including the attacker\u0027s \u2014 can read them, giving direct kernel memory disclosure.\nI:H - `cf-\u003elen` read from reclaimed memory is unbounded (up to 255), so the write loop overruns the mailbox\u0027s data window and writes attacker-influenced dwords into adjacent CAN controller registers, and a UAF of this kind is generally leverageable into heap-spray-based write primitives; it also injects arbitrary frame content onto a safety-critical bus.\nA:H - The use-after-free triggers a KASAN panic on hardened kernels, and the out-of-bounds register writes plus lost echo-SKB accounting corrupt controller state and permanently wedge the TX queue (`netif_stop_queue()` with no matching completion), producing a crash or denial of CAN service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:05:49.898Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e202ffd9e54538ef67ec301ebd6d9da4823466c9"
        },
        {
          "url": "https://git.kernel.org/stable/c/1139321161a3ba5e45e61e0738b37f42f20bc57a"
        },
        {
          "url": "https://git.kernel.org/stable/c/94b050726288a56a6b8ff55aa641f2fedbd3b44c"
        },
        {
          "url": "https://git.kernel.org/stable/c/725b33deebd6e4c96fe7893f384510a54258f28f"
        },
        {
          "url": "https://git.kernel.org/stable/c/668cc1e3bb21101d074e430de1b7ba8fd10189e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef79f00be72bd81d2e1e6f060d83cf7e425deee4"
        }
      ],
      "title": "can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39873",
    "datePublished": "2025-09-23T06:00:46.157Z",
    "dateReserved": "2025-04-16T07:20:57.144Z",
    "dateUpdated": "2026-08-05T12:05:49.898Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39873",
      "date": "2026-08-08",
      "epss": "0.00148",
      "percentile": "0.04459"
    },
    "microsoft_vex": {
      "current_release_date": "2025-09-24T01:02:10.000Z",
      "cve": "CVE-2025-39873",
      "id": "msrc_CVE-2025-39873",
      "initial_release_date": "2025-09-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-39873.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-39873\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-23T06:15:46.670\",\"lastModified\":\"2026-07-30T06:23:53.267\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncan: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB\\n\\ncan_put_echo_skb() takes ownership of the SKB and it may be freed\\nduring or after the call.\\n\\nHowever, xilinx_can xcan_write_frame() keeps using SKB after the call.\\n\\nFix that by only calling can_put_echo_skb() after the code is done\\ntouching the SKB.\\n\\nThe tx_lock is held for the entire xcan_write_frame() execution and\\nalso on the can_get_echo_skb() side so the order of operations does not\\nmatter.\\n\\nAn earlier fix commit 3d3c817c3a40 (\\\"can: xilinx_can: Fix usage of skb\\nmemory\\\") did not move the can_put_echo_skb() call far enough.\\n\\n[mkl: add \\\"commit\\\" in front of sha1 in patch description]\\n[mkl: fix indention]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/can/xilinx_can.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1598efe57b3e768056e4ca56cb9cf33111e68d1c\",\"lessThan\":\"e202ffd9e54538ef67ec301ebd6d9da4823466c9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1598efe57b3e768056e4ca56cb9cf33111e68d1c\",\"lessThan\":\"1139321161a3ba5e45e61e0738b37f42f20bc57a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1598efe57b3e768056e4ca56cb9cf33111e68d1c\",\"lessThan\":\"94b050726288a56a6b8ff55aa641f2fedbd3b44c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1598efe57b3e768056e4ca56cb9cf33111e68d1c\",\"lessThan\":\"725b33deebd6e4c96fe7893f384510a54258f28f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1598efe57b3e768056e4ca56cb9cf33111e68d1c\",\"lessThan\":\"668cc1e3bb21101d074e430de1b7ba8fd10189e7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1598efe57b3e768056e4ca56cb9cf33111e68d1c\",\"lessThan\":\"ef79f00be72bd81d2e1e6f060d83cf7e425deee4\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/can/xilinx_can.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.194\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.153\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.107\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.48\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16.8\",\"lessThanOrEqual\":\"6.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.19\",\"versionEndExcluding\":\"5.15.194\",\"matchCriteriaId\":\"2B598466-E062-48BA-BF88-7ABF4A73723F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.153\",\"matchCriteriaId\":\"39B3B4F7-FA64-4E7C-B55D-53A5D004A639\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.107\",\"matchCriteriaId\":\"D273EDA6-2CFE-4EBD-B024-62EB057830F3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.48\",\"matchCriteriaId\":\"9652E701-5C8E-49CF-89A5-499E214A5902\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.16.8\",\"matchCriteriaId\":\"8DA00A4E-AABB-4A69-AB39-67B22D0B36D2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"327D22EF-390B-454C-BD31-2ED23C998A1C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C730CD9A-D969-4A8E-9522-162AAF7C0EE9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"39982C4B-716E-4B2F-8196-FA301F47807D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"340BEEA9-D70D-4290-B502-FBB1032353B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"47E4C5C0-079F-4838-971B-8C503D48FCC2\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1139321161a3ba5e45e61e0738b37f42f20bc57a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/668cc1e3bb21101d074e430de1b7ba8fd10189e7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/725b33deebd6e4c96fe7893f384510a54258f28f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/94b050726288a56a6b8ff55aa641f2fedbd3b44c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e202ffd9e54538ef67ec301ebd6d9da4823466c9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ef79f00be72bd81d2e1e6f060d83cf7e425deee4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:18:20+00:00",
      "cve": "CVE-2025-39873",
      "id": "CVE-2025-39873",
      "initial_release_date": "2025-09-23T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39873.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-19T17:47:43Z",
      "cve": "CVE-2025-39873",
      "id": "CVE-2025-39873",
      "initial_release_date": "2025-09-23T23:23:40Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "568",
      "product_status:known_not_affected": "97",
      "product_status:recommended": "500",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-39873",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-39873.json",
      "version": "54"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.