CVE-2025-39873— can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB
Affected Version Matrix 14
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 1598efe57b3e768056e4ca56cb9cf33111e68d1c< e202ffd9e54538ef67ec301ebd6d9da4823466c9 | affected |
1598efe57b3e768056e4ca56cb9cf33111e68d1c< 1139321161a3ba5e45e61e0738b37f42f20bc57a | affected | ||
1598efe57b3e768056e4ca56cb9cf33111e68d1c< 94b050726288a56a6b8ff55aa641f2fedbd3b44c | affected | ||
1598efe57b3e768056e4ca56cb9cf33111e68d1c< 725b33deebd6e4c96fe7893f384510a54258f28f | affected | ||
1598efe57b3e768056e4ca56cb9cf33111e68d1c< 668cc1e3bb21101d074e430de1b7ba8fd10189e7 | affected | ||
1598efe57b3e768056e4ca56cb9cf33111e68d1c< ef79f00be72bd81d2e1e6f060d83cf7e425deee4 | affected | ||
4.19 | affected | ||
< 4.19 | unaffected | ||
| … +6 more rows | |||
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-39873
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB can_put_echo_skb() takes ownership of the SKB and it may be freed during or after the call. However, xilinx_can xcan_write_frame() keeps using SKB after the call. Fix that by only calling can_put_echo_skb() after the code is done touching the SKB. The tx_lock is held for the entire xcan_write_frame() execution and also on the can_get_echo_skb() side so the order of operations does not matter. An earlier fix commit 3d3c817c3a40 ("can: xilinx_can: Fix usage of skb memory") did not move the can_put_echo_skb() call far enough. [mkl: add "commit" in front of sha1 in patch description] [mkl: fix indention]
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于xcan_write_frame函数在调用can_put_echo_skb后继续使用已释放的SKB，可能导致释放后重用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-39873
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-39873
请登录查看更多情报信息。
Same Patch Batch · Linux · 2025-09-23 · 21 CVEs total
| CVE-2025-39878 | ceph: fix crash after fscrypt_encrypt_pagecache_blocks() error | |
| CVE-2025-39887 | tracing/osnoise: Fix null-ptr-deref in bitmap_parselist() | |
| CVE-2025-39888 | fuse: Block access to folio overlimit | |
| CVE-2025-39885 | ocfs2: fix recursive semaphore deadlock in fiemap call | |
| CVE-2025-39886 | bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() | |
| CVE-2025-39883 | mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory | |
| CVE-2025-39884 | btrfs: fix subvolume deletion lockup caused by inodes xarray race | |
| CVE-2025-39882 | drm/mediatek: fix potential OF node use-after-free | |
| CVE-2025-39880 | libceph: fix invalid accesses to ceph_connection_v1_info | |
| CVE-2025-39881 | kernfs: Fix UAF in polling when open file is released | |
| CVE-2025-39868 | erofs: fix runtime warning on truncate_folio_batch_exceptionals() | |
| CVE-2025-39879 | ceph: always call ceph_shift_unused_folios_left() | |
| CVE-2025-39877 | mm/damon/sysfs: fix use-after-free in state_show() | |
| CVE-2025-39876 | net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() | |
| CVE-2025-39874 | macsec: sync features on RTM_NEWLINK | |
| CVE-2025-39875 | igb: Fix NULL pointer dereference in ethtool loopback test | |
| CVE-2025-39872 | hsr: hold rcu and dev lock for hsr_get_port_ndev | |
| CVE-2025-39871 | dmaengine: idxd: Remove improper idxd_free | |
| CVE-2025-39869 | dmaengine: ti: edma: Fix memory allocation size for queue_priority_map | |
| CVE-2025-39870 | dmaengine: idxd: Fix double free in idxd_setup_wqs() |
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-46333
ptrace: slightly saner 'get_dumpable()' logic - CVE-2026-43490
ksmbd: validate inherited ACE SID length - CVE-2026-43489
liveupdate: luo_file: remember retrieve() status - CVE-2026-43487
ata: libata-core: Disable LPM on ST1000DM010-2EP102 - CVE-2026-43488
usb: xhci: Prevent interrupt storm on host controller error
Same vendor: Linux
- CVE-2026-46333
ptrace: slightly saner 'get_dumpable()' logic - CVE-2026-43490
ksmbd: validate inherited ACE SID length - CVE-2026-43489
liveupdate: luo_file: remember retrieve() status - CVE-2026-43487
ata: libata-core: Disable LPM on ST1000DM010-2EP102 - CVE-2026-43488
usb: xhci: Prevent interrupt storm on host controller error
V. Comments for CVE-2025-39873
No comments yet