CVE-2025-39873

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-39873", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.144Z", "datePublished": "2025-09-23T06:00:46.157Z", "dateUpdated": "2026-08-05T12:05:49.898Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:05:49.898Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB\n\ncan_put_echo_skb() takes ownership of the SKB and it may be freed\nduring or after the call.\n\nHowever, xilinx_can xcan_write_frame() keeps using SKB after the call.\n\nFix that by only calling can_put_echo_skb() after the code is done\ntouching the SKB.\n\nThe tx_lock is held for the entire xcan_write_frame() execution and\nalso on the can_get_echo_skb() side so the order of operations does not\nmatter.\n\nAn earlier fix commit 3d3c817c3a40 (\"can: xilinx_can: Fix usage of skb\nmemory\") did not move the can_put_echo_skb() call far enough.\n\n[mkl: add \"commit\" in front of sha1 in patch description]\n[mkl: fix indention]"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is only reached from `ndo_start_xmit` on the xilinx_can device, i.e. by a local process transmitting a frame through a `PF_CAN` socket (`sendmsg()`); received bus traffic does not enter this path. Exploitation therefore requires local system access.\nAC:L - The attacker drives both the transmission and the conditions that make `can_put_echo_skb()` free the SKB (TX flooding to saturate the FIFO/echo slots, memory pressure to fail the `GFP_ATOMIC` `skb_clone`), and can retry indefinitely at line rate; the free is not a race the attacker cannot influence.\nPR:L - `can_create()` in net/can/af_can.c and the CAN_RAW protocol perform no capability check, so any unprivileged local user can open a raw CAN socket, bind it to the interface and transmit. No root or CAP_NET_ADMIN is needed to reach `xcan_write_frame()`.\nUI:N - The attacker's own `sendmsg()` call drives the whole path; no victim action or cooperation is required.\nS:U - The corruption stays within the kernel's own security authority \u2014 freed kernel heap and the driver's MMIO window \u2014 with no crossing of a hypervisor, IOMMU or sandbox boundary.\nC:H - The UAF reads freed (and, with a groomed `cf->len`, out-of-bounds) kernel heap contents and writes them into the CAN controller's TX registers, which are then transmitted on the physical CAN bus where any node \u2014 including the attacker's \u2014 can read them, giving direct kernel memory disclosure.\nI:H - `cf->len` read from reclaimed memory is unbounded (up to 255), so the write loop overruns the mailbox's data window and writes attacker-influenced dwords into adjacent CAN controller registers, and a UAF of this kind is generally leverageable into heap-spray-based write primitives; it also injects arbitrary frame content onto a safety-critical bus.\nA:H - The use-after-free triggers a KASAN panic on hardened kernels, and the out-of-bounds register writes plus lost echo-SKB accounting corrupt controller state and permanently wedge the TX queue (`netif_stop_queue()` with no matching completion), producing a crash or denial of CAN service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/can/xilinx_can.c"], "versions": [{"version": "1598efe57b3e768056e4ca56cb9cf33111e68d1c", "lessThan": "e202ffd9e54538ef67ec301ebd6d9da4823466c9", "status": "affected", "versionType": "git"}, {"version": "1598efe57b3e768056e4ca56cb9cf33111e68d1c", "lessThan": "1139321161a3ba5e45e61e0738b37f42f20bc57a", "status": "affected", "versionType": "git"}, {"version": "1598efe57b3e768056e4ca56cb9cf33111e68d1c", "lessThan": "94b050726288a56a6b8ff55aa641f2fedbd3b44c", "status": "affected", "versionType": "git"}, {"version": "1598efe57b3e768056e4ca56cb9cf33111e68d1c", "lessThan": "725b33deebd6e4c96fe7893f384510a54258f28f", "status": "affected", "versionType": "git"}, {"version": "1598efe57b3e768056e4ca56cb9cf33111e68d1c", "lessThan": "668cc1e3bb21101d074e430de1b7ba8fd10189e7", "status": "affected", "versionType": "git"}, {"version": "1598efe57b3e768056e4ca56cb9cf33111e68d1c", "lessThan": "ef79f00be72bd81d2e1e6f060d83cf7e425deee4", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/can/xilinx_can.c"], "versions": [{"version": "4.19", "status": "affected"}, {"version": "0", "lessThan": "4.19", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.194", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.153", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.107", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.48", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16.8", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.15.194"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.1.153"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.6.107"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.12.48"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.16.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.17"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e202ffd9e54538ef67ec301ebd6d9da4823466c9"}, {"url": "https://git.kernel.org/stable/c/1139321161a3ba5e45e61e0738b37f42f20bc57a"}, {"url": "https://git.kernel.org/stable/c/94b050726288a56a6b8ff55aa641f2fedbd3b44c"}, {"url": "https://git.kernel.org/stable/c/725b33deebd6e4c96fe7893f384510a54258f28f"}, {"url": "https://git.kernel.org/stable/c/668cc1e3bb21101d074e430de1b7ba8fd10189e7"}, {"url": "https://git.kernel.org/stable/c/ef79f00be72bd81d2e1e6f060d83cf7e425deee4"}], "title": "can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:44:20.103Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/can/xilinx_can.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e202ffd9e54538ef67ec301ebd6d9da4823466c9", "status": "affected", "version": "1598efe57b3e768056e4ca56cb9cf33111e68d1c", "versionType": "git"}, {"lessThan": "1139321161a3ba5e45e61e0738b37f42f20bc57a", "status": "affected", "version": "1598efe57b3e768056e4ca56cb9cf33111e68d1c", "versionType": "git"}, {"lessThan": "94b050726288a56a6b8ff55aa641f2fedbd3b44c", "status": "affected", "version": "1598efe57b3e768056e4ca56cb9cf33111e68d1c", "versionType": "git"}, {"lessThan": "725b33deebd6e4c96fe7893f384510a54258f28f", "status": "affected", "version": "1598efe57b3e768056e4ca56cb9cf33111e68d1c", "versionType": "git"}, {"lessThan": "668cc1e3bb21101d074e430de1b7ba8fd10189e7", "status": "affected", "version": "1598efe57b3e768056e4ca56cb9cf33111e68d1c", "versionType": "git"}, {"lessThan": "ef79f00be72bd81d2e1e6f060d83cf7e425deee4", "status": "affected", "version": "1598efe57b3e768056e4ca56cb9cf33111e68d1c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/can/xilinx_can.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.19"}, {"lessThan": "4.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.194", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.153", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.107", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.48", "versionType": "semver"}, {"lessThanOrEqual": "6.16.*", "status": "unaffected", "version": "6.16.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2B598466-E062-48BA-BF88-7ABF4A73723F", "versionEndExcluding": "5.15.194", "versionStartIncluding": "4.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "39B3B4F7-FA64-4E7C-B55D-53A5D004A639", "versionEndExcluding": "6.1.153", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D273EDA6-2CFE-4EBD-B024-62EB057830F3", "versionEndExcluding": "6.6.107", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9652E701-5C8E-49CF-89A5-499E214A5902", "versionEndExcluding": "6.12.48", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8DA00A4E-AABB-4A69-AB39-67B22D0B36D2", "versionEndExcluding": "6.16.8", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*", "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*", "matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*", "matchCriteriaId": "39982C4B-716E-4B2F-8196-FA301F47807D", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*", "matchCriteriaId": "340BEEA9-D70D-4290-B502-FBB1032353B1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc5:*:*:*:*:*:*", "matchCriteriaId": "47E4C5C0-079F-4838-971B-8C503D48FCC2", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB\n\ncan_put_echo_skb() takes ownership of the SKB and it may be freed\nduring or after the call.\n\nHowever, xilinx_can xcan_write_frame() keeps using SKB after the call.\n\nFix that by only calling can_put_echo_skb() after the code is done\ntouching the SKB.\n\nThe tx_lock is held for the entire xcan_write_frame() execution and\nalso on the can_get_echo_skb() side so the order of operations does not\nmatter.\n\nAn earlier fix commit 3d3c817c3a40 (\"can: xilinx_can: Fix usage of skb\nmemory\") did not move the can_put_echo_skb() call far enough.\n\n[mkl: add \"commit\" in front of sha1 in patch description]\n[mkl: fix indention]"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncan: xilinx_can: xcan_write_frame(): corregir uso despu\u00e9s de liberaci\u00f3n del SKB transmitido\n\ncan_put_echo_skb() toma posesi\u00f3n del SKB y este puede ser liberado durante o despu\u00e9s de la llamada.\n\nSin embargo, xilinx_can xcan_write_frame() sigue usando el SKB despu\u00e9s de la llamada.\n\nCorregir eso llamando a can_put_echo_skb() solo despu\u00e9s de que el c\u00f3digo haya terminado de manipular el SKB.\n\nEl tx_lock se mantiene durante toda la ejecuci\u00f3n de xcan_write_frame() y tambi\u00e9n en el lado de can_get_echo_skb(), por lo que el orden de las operaciones no importa.\n\nUn commit de correcci\u00f3n anterior 3d3c817c3a40 ('can: xilinx_can: Corregir el uso de la memoria skb') no movi\u00f3 la llamada a can_put_echo_skb() lo suficientemente lejos.\n\n[mkl: a\u00f1adir 'commit' delante de sha1 en la descripci\u00f3n del parche]\n[mkl: corregir sangr\u00eda]"}], "id": "CVE-2025-39873", "lastModified": "2026-10-19T21:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-09-23T06:15:46.670", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1139321161a3ba5e45e61e0738b37f42f20bc57a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/668cc1e3bb21101d074e430de1b7ba8fd10189e7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/725b33deebd6e4c96fe7893f384510a54258f28f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/94b050726288a56a6b8ff55aa641f2fedbd3b44c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e202ffd9e54538ef67ec301ebd6d9da4823466c9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ef79f00be72bd81d2e1e6f060d83cf7e425deee4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB", "id": "2397568", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397568"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-39873", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-09-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-39873\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-39873\nhttps://lore.kernel.org/linux-cve-announce/2025092300-CVE-2025-39873-94d3@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-09-23T16:03:19.295322+00:00", "updated": "2025-09-23T16:03:19.295386+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}