AZL-67650
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-67650.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/AZL-67650
- Upstream
- Published
- 2025-09-23T06:15:46Z
- Modified
- 2026-04-01T05:21:15Z
- Summary
- CVE-2025-39873 affecting package kernel for versions less than 6.6.112.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB
can_put_echo_skb() takes ownership of the SKB and it may be freed during or after the call.
However, xilinx_can xcan_write_frame() keeps using SKB after the call.
Fix that by only calling can_put_echo_skb() after the code is done touching the SKB.
The tx_lock is held for the entire xcan_write_frame() execution and also on the can_get_echo_skb() side so the order of operations does not matter.
An earlier fix commit 3d3c817c3a40 ("can: xilinx_can: Fix usage of skb memory") did not move the can_put_echo_skb() call far enough.
[mkl: add "commit" in front of sha1 in patch description] [mkl: fix indention]
- References