In the Linux kernel, the following vulnerability has been resolved:
can: xilinxcan: xcanwrite_frame(): fix use-after-free of transmitted SKB
canputecho_skb() takes ownership of the SKB and it may be freed during or after the call.
However, xilinxcan xcanwrite_frame() keeps using SKB after the call.
Fix that by only calling canputecho_skb() after the code is done touching the SKB.
The txlock is held for the entire xcanwriteframe() execution and also on the cangetechoskb() side so the order of operations does not matter.
An earlier fix commit 3d3c817c3a40 ("can: xilinxcan: Fix usage of skb memory") did not move the canputechoskb() call far enough.
[mkl: add "commit" in front of sha1 in patch description] [mkl: fix indention]
[
{
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef79f00be72bd81d2e1e6f060d83cf7e425deee4",
"digest": {
"threshold": 0.9,
"line_hashes": [
"338008729533608964580317283416476884402",
"98412465030211088690939976242357558140",
"281891032902358370568522837842204600943",
"140267662616991118754983356816591604910",
"54323149701269582580155018630269381578",
"14021950281645197702363170814482205999",
"73519938582397604045635416389026765253",
"165085013139834377136203942679564582257",
"31097741747326304107770446449019829429",
"340207649932800510152367701704357410852",
"63711576063305287132413890189095854321",
"104261242821859287949721602752913866608",
"60361090381248883125139901831623343704"
]
},
"id": "CVE-2025-39873-039af42b",
"signature_type": "Line",
"target": {
"file": "drivers/net/can/xilinx_can.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1139321161a3ba5e45e61e0738b37f42f20bc57a",
"digest": {
"threshold": 0.9,
"line_hashes": [
"338008729533608964580317283416476884402",
"98412465030211088690939976242357558140",
"281891032902358370568522837842204600943",
"140267662616991118754983356816591604910",
"54323149701269582580155018630269381578",
"14021950281645197702363170814482205999",
"73519938582397604045635416389026765253",
"165085013139834377136203942679564582257",
"31097741747326304107770446449019829429",
"340207649932800510152367701704357410852",
"63711576063305287132413890189095854321",
"104261242821859287949721602752913866608",
"60361090381248883125139901831623343704"
]
},
"id": "CVE-2025-39873-10922de7",
"signature_type": "Line",
"target": {
"file": "drivers/net/can/xilinx_can.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@668cc1e3bb21101d074e430de1b7ba8fd10189e7",
"digest": {
"threshold": 0.9,
"line_hashes": [
"338008729533608964580317283416476884402",
"98412465030211088690939976242357558140",
"281891032902358370568522837842204600943",
"140267662616991118754983356816591604910",
"54323149701269582580155018630269381578",
"14021950281645197702363170814482205999",
"73519938582397604045635416389026765253",
"165085013139834377136203942679564582257",
"31097741747326304107770446449019829429",
"340207649932800510152367701704357410852",
"63711576063305287132413890189095854321",
"104261242821859287949721602752913866608",
"60361090381248883125139901831623343704"
]
},
"id": "CVE-2025-39873-2d0f2ea9",
"signature_type": "Line",
"target": {
"file": "drivers/net/can/xilinx_can.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@668cc1e3bb21101d074e430de1b7ba8fd10189e7",
"digest": {
"function_hash": "56653788881605949578460727448416720232",
"length": 1893.0
},
"id": "CVE-2025-39873-5434e7ca",
"signature_type": "Function",
"target": {
"function": "xcan_write_frame",
"file": "drivers/net/can/xilinx_can.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1139321161a3ba5e45e61e0738b37f42f20bc57a",
"digest": {
"function_hash": "56653788881605949578460727448416720232",
"length": 1893.0
},
"id": "CVE-2025-39873-5cca99d0",
"signature_type": "Function",
"target": {
"function": "xcan_write_frame",
"file": "drivers/net/can/xilinx_can.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef79f00be72bd81d2e1e6f060d83cf7e425deee4",
"digest": {
"function_hash": "56653788881605949578460727448416720232",
"length": 1893.0
},
"id": "CVE-2025-39873-b33147ca",
"signature_type": "Function",
"target": {
"function": "xcan_write_frame",
"file": "drivers/net/can/xilinx_can.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@725b33deebd6e4c96fe7893f384510a54258f28f",
"digest": {
"function_hash": "56653788881605949578460727448416720232",
"length": 1893.0
},
"id": "CVE-2025-39873-cce8da02",
"signature_type": "Function",
"target": {
"function": "xcan_write_frame",
"file": "drivers/net/can/xilinx_can.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e202ffd9e54538ef67ec301ebd6d9da4823466c9",
"digest": {
"function_hash": "56653788881605949578460727448416720232",
"length": 1893.0
},
"id": "CVE-2025-39873-d3dbecb8",
"signature_type": "Function",
"target": {
"function": "xcan_write_frame",
"file": "drivers/net/can/xilinx_can.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@725b33deebd6e4c96fe7893f384510a54258f28f",
"digest": {
"threshold": 0.9,
"line_hashes": [
"338008729533608964580317283416476884402",
"98412465030211088690939976242357558140",
"281891032902358370568522837842204600943",
"140267662616991118754983356816591604910",
"54323149701269582580155018630269381578",
"14021950281645197702363170814482205999",
"73519938582397604045635416389026765253",
"165085013139834377136203942679564582257",
"31097741747326304107770446449019829429",
"340207649932800510152367701704357410852",
"63711576063305287132413890189095854321",
"104261242821859287949721602752913866608",
"60361090381248883125139901831623343704"
]
},
"id": "CVE-2025-39873-e77852bf",
"signature_type": "Line",
"target": {
"file": "drivers/net/can/xilinx_can.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e202ffd9e54538ef67ec301ebd6d9da4823466c9",
"digest": {
"threshold": 0.9,
"line_hashes": [
"338008729533608964580317283416476884402",
"98412465030211088690939976242357558140",
"281891032902358370568522837842204600943",
"140267662616991118754983356816591604910",
"54323149701269582580155018630269381578",
"14021950281645197702363170814482205999",
"73519938582397604045635416389026765253",
"165085013139834377136203942679564582257",
"31097741747326304107770446449019829429",
"340207649932800510152367701704357410852",
"63711576063305287132413890189095854321",
"104261242821859287949721602752913866608",
"60361090381248883125139901831623343704"
]
},
"id": "CVE-2025-39873-f04ae318",
"signature_type": "Line",
"target": {
"file": "drivers/net/can/xilinx_can.c"
}
}
]