https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 01:23:57 +0000 https://vulnerability.circl.lu/vuln/cve-2025-39873 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB</p> <p>can_put_echo_skb() takes ownership of the SKB and it may be freed during or after the call.</p> <p>However, xilinx_can xcan_write_frame() keeps using SKB after the call.</p> <p>Fix that by only calling can_put_echo_skb() after the code is done touching the SKB.</p> <p>The tx_lock is held for the entire xcan_write_frame() execution and also on the can_get_echo_skb() side so the order of operations does not matter.</p> <p>An earlier fix commit 3d3c817c3a40 (&#34;can: xilinx_can: Fix usage of skb memory&#34;) did not move the can_put_echo_skb() call far enough.</p> <p>[mkl: add &#34;commit&#34; in front of sha1 in patch description] [mkl: fix indention]</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB</p> <p>can_put_echo_skb() takes ownership of the SKB and it may be freed during or after the call.</p> <p>However, xilinx_can xcan_write_frame() keeps using SKB after the call.</p> <p>Fix that by only calling can_put_echo_skb() after the code is done touching the SKB.</p> <p>The tx_lock is held for the entire xcan_write_frame() execution and also on the can_get_echo_skb() side so the order of operations does not matter.</p> <p>An earlier fix commit 3d3c817c3a40 (&#34;can: xilinx_can: Fix usage of skb memory&#34;) did not move the can_put_echo_skb() call far enough.</p> <p>[mkl: add &#34;commit&#34; in front of sha1 in patch description] [mkl: fix indention]</p> https://vulnerability.circl.lu/vuln/cve-2025-39873