{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2020-36789",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T17:02:36.182162Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T17:02:39.312Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "248b71ce92d4f3a574b2537f9838f48e892618f4",
              "status": "affected",
              "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
              "versionType": "git"
            },
            {
              "lessThan": "451187b20431924d13fcfecc500d7cd2d9951bac",
              "status": "affected",
              "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
              "versionType": "git"
            },
            {
              "lessThan": "3a922a85701939624484e7f2fd07d32beed00d25",
              "status": "affected",
              "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
              "versionType": "git"
            },
            {
              "lessThan": "7e4cf2ec0ca236c3e5f904239cec6efe1f3baf22",
              "status": "affected",
              "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
              "versionType": "git"
            },
            {
              "lessThan": "ab46748bf98864f9c3f5559060bf8caf9df2b41e",
              "status": "affected",
              "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
              "versionType": "git"
            },
            {
              "lessThan": "87530b557affe01c764de32dbeb58cdf47234574",
              "status": "affected",
              "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
              "versionType": "git"
            },
            {
              "lessThan": "2283f79b22684d2812e5c76fc2280aae00390365",
              "status": "affected",
              "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.31"
            },
            {
              "lessThan": "2.6.31",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.4.*",
              "status": "unaffected",
              "version": "4.4.244",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.244",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.207",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.9.*",
              "status": "unaffected",
              "version": "5.9.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.4.244",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.244",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.207",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.158",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.78",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.9.9",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context\n\nIf a driver calls can_get_echo_skb() during a hardware IRQ (which is often, but\nnot always, the case), the \u0027WARN_ON(in_irq)\u0027 in\nnet/core/skbuff.c#skb_release_head_state() might be triggered, under network\ncongestion circumstances, together with the potential risk of a NULL pointer\ndereference.\n\nThe root cause of this issue is the call to kfree_skb() instead of\ndev_kfree_skb_irq() in net/core/dev.c#enqueue_to_backlog().\n\nThis patch prevents the skb to be freed within the call to netif_rx() by\nincrementing its reference count with skb_get(). The skb is finally freed by\none of the in-irq-context safe functions: dev_consume_skb_any() or\ndev_kfree_skb_any(). The \"any\" version is used because some drivers might call\ncan_get_echo_skb() in a normal context.\n\nThe reason for this issue to occur is that initially, in the core network\nstack, loopback skb were not supposed to be received in hardware IRQ context.\nThe CAN stack is an exeption.\n\nThis bug was previously reported back in 2017 in [1] but the proposed patch\nnever got accepted.\n\nWhile [1] directly modifies net/core/dev.c, we try to propose here a\nsmoother modification local to CAN network stack (the assumption\nbehind is that only CAN devices are affected by this issue).\n\n[1] http://lore.kernel.org/r/57a3ffb6-3309-3ad5-5a34-e93c3fe3614d@cetitec.com"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T13:42:55.817Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/248b71ce92d4f3a574b2537f9838f48e892618f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/451187b20431924d13fcfecc500d7cd2d9951bac"
        },
        {
          "url": "https://git.kernel.org/stable/c/3a922a85701939624484e7f2fd07d32beed00d25"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e4cf2ec0ca236c3e5f904239cec6efe1f3baf22"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab46748bf98864f9c3f5559060bf8caf9df2b41e"
        },
        {
          "url": "https://git.kernel.org/stable/c/87530b557affe01c764de32dbeb58cdf47234574"
        },
        {
          "url": "https://git.kernel.org/stable/c/2283f79b22684d2812e5c76fc2280aae00390365"
        }
      ],
      "title": "can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2020-36789",
    "datePublished": "2025-04-17T18:01:28.613Z",
    "dateReserved": "2024-02-26T17:07:27.435Z",
    "dateUpdated": "2026-05-11T13:42:55.817Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_plane.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4ab7e453a3ee88c274cf97bee9487ab92a66d313",
              "status": "affected",
              "version": "e6fc3b68558e4c6d8d160b5daf2511b99afa8814",
              "versionType": "git"
            },
            {
              "lessThan": "1e29d829ad51d1472dd035487953a6724b56fc33",
              "status": "affected",
              "version": "e6fc3b68558e4c6d8d160b5daf2511b99afa8814",
              "versionType": "git"
            },
            {
              "lessThan": "b5cd108143513e4498027b96ec4710702d186f11",
              "status": "affected",
              "version": "e6fc3b68558e4c6d8d160b5daf2511b99afa8814",
              "versionType": "git"
            },
            {
              "lessThan": "978e3d023256bfaf34a0033d40c94e8a8e70cf3c",
              "status": "affected",
              "version": "e6fc3b68558e4c6d8d160b5daf2511b99afa8814",
              "versionType": "git"
            },
            {
              "lessThan": "787163d19bc3cdc6ca4b96223f62208534d1cf6b",
              "status": "affected",
              "version": "e6fc3b68558e4c6d8d160b5daf2511b99afa8814",
              "versionType": "git"
            },
            {
              "lessThan": "ad6dd7a2bac86118985c7b3426e175b9d3c1ec4f",
              "status": "affected",
              "version": "e6fc3b68558e4c6d8d160b5daf2511b99afa8814",
              "versionType": "git"
            },
            {
              "lessThan": "4b674dd69701c2e22e8e7770c1706a69f3b17269",
              "status": "affected",
              "version": "e6fc3b68558e4c6d8d160b5daf2511b99afa8814",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_plane.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.247",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.121",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.247",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.198",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.121",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.46",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.14",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.3",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/plane: Move range check for format_count earlier\n\nWhile the check for format_count \u003e 64 in __drm_universal_plane_init()\nshouldn\u0027t be hit (it\u0027s a WARN_ON), in its current position it will then\nleak the plane-\u003eformat_types array and fail to call\ndrm_mode_object_unregister() leaking the modeset identifier. Move it to\nthe start of the function to avoid allocating those resources in the\nfirst place."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T13:58:47.008Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4ab7e453a3ee88c274cf97bee9487ab92a66d313"
        },
        {
          "url": "https://git.kernel.org/stable/c/1e29d829ad51d1472dd035487953a6724b56fc33"
        },
        {
          "url": "https://git.kernel.org/stable/c/b5cd108143513e4498027b96ec4710702d186f11"
        },
        {
          "url": "https://git.kernel.org/stable/c/978e3d023256bfaf34a0033d40c94e8a8e70cf3c"
        },
        {
          "url": "https://git.kernel.org/stable/c/787163d19bc3cdc6ca4b96223f62208534d1cf6b"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad6dd7a2bac86118985c7b3426e175b9d3c1ec4f"
        },
        {
          "url": "https://git.kernel.org/stable/c/4b674dd69701c2e22e8e7770c1706a69f3b17269"
        }
      ],
      "title": "drm/plane: Move range check for format_count earlier",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47659",
    "datePublished": "2025-02-26T02:05:56.954Z",
    "dateReserved": "2025-02-26T02:04:38.057Z",
    "dateUpdated": "2026-05-11T13:58:47.008Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-47668",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-17T18:17:56.944235Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-17T18:25:25.427Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "260925a0b7d2da5449f8ecfd02c1405e0c8a45b8",
              "status": "affected",
              "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
              "versionType": "git"
            },
            {
              "lessThan": "bbc6847b9b8978b520f62fbc7c68c54ef0f8d282",
              "status": "affected",
              "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
              "versionType": "git"
            },
            {
              "lessThan": "92668d28c7e6a7a2ba07df287669ffcdf650c421",
              "status": "affected",
              "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
              "versionType": "git"
            },
            {
              "lessThan": "08ab951787098ae0b6c0364aeea7a8138226f234",
              "status": "affected",
              "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
              "versionType": "git"
            },
            {
              "lessThan": "ac48ef15826e83f4206c47add61072e8fc76d328",
              "status": "affected",
              "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
              "versionType": "git"
            },
            {
              "lessThan": "593c072b7b3c4d7044416eb039d9ad706bedd67a",
              "status": "affected",
              "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
              "versionType": "git"
            },
            {
              "lessThan": "03f16c5075b22c8902d2af739969e878b0879c94",
              "status": "affected",
              "version": "39549eef3587f1c1e8c65c88a2400d10fd30ea17",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.31"
            },
            {
              "lessThan": "2.6.31",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.4.*",
              "status": "unaffected",
              "version": "4.4.254",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.254",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.218",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.171",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.4.254",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.254",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.218",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.171",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.93",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.11",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.11",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: dev: can_restart: fix use after free bug\n\nAfter calling netif_rx_ni(skb), dereferencing skb is unsafe.\nEspecially, the can_frame cf which aliases skb memory is accessed\nafter the netif_rx_ni() in:\n      stats-\u003erx_bytes += cf-\u003elen;\n\nReordering the lines solves the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable can_restart path runs after CAN bus-off recovery on real CAN interfaces; an attacker on the same CAN segment can induce bus-off (a known CAN bus-off attack), analogous to Bluetooth/Wi\u2011Fi adjacent reachability rather than internet Network or host-local only.\nAC:L - Bus-off can be reliably forced from the CAN bus, and with automatic recovery (restart-ms) configured\u2014documented and common in automotive/industrial deployments\u2014delayed work deterministically calls can_restart; netif_rx_ni runs softirq and can_receive always frees the skb before cf-\u003elen is read.\nPR:N - An adjacent CAN attacker needs no host account or capabilities; bus-off is triggered by on-bus error conditions and the kernel schedules can_restart when restart-ms is already enabled by the deployment.\nUI:N - No victim user action is required; bus-off and subsequent automatic restart occur from attacker-driven bus errors and kernel workqueue handling alone.\nS:U - This is a kernel-context use-after-free within the same host kernel authority; it does not cross VM, IOMMU, or other security boundaries.\nC:H - Use-after-free of the CAN error skb after netif_rx_ni frees it enables reading reallocated heap contents (cf aliases skb data), which per kernel UAF guidance is High confidentiality impact.\nI:H - Kernel UAF of an sk_buff object is treated as enabling heap reuse and control-flow/corruption primitives, so Integrity is High even though the immediate buggy access is a post-free read into stats.\nA:H - Dereferencing freed skb memory can oops/panic the kernel, and any use-after-free is scored High for availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:48:48.169Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/260925a0b7d2da5449f8ecfd02c1405e0c8a45b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/bbc6847b9b8978b520f62fbc7c68c54ef0f8d282"
        },
        {
          "url": "https://git.kernel.org/stable/c/92668d28c7e6a7a2ba07df287669ffcdf650c421"
        },
        {
          "url": "https://git.kernel.org/stable/c/08ab951787098ae0b6c0364aeea7a8138226f234"
        },
        {
          "url": "https://git.kernel.org/stable/c/ac48ef15826e83f4206c47add61072e8fc76d328"
        },
        {
          "url": "https://git.kernel.org/stable/c/593c072b7b3c4d7044416eb039d9ad706bedd67a"
        },
        {
          "url": "https://git.kernel.org/stable/c/03f16c5075b22c8902d2af739969e878b0879c94"
        }
      ],
      "title": "can: dev: can_restart: fix use after free bug",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47668",
    "datePublished": "2025-04-17T18:01:29.315Z",
    "dateReserved": "2025-04-16T07:16:05.752Z",
    "dateUpdated": "2026-08-05T08:48:48.169Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-47669",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-17T18:17:52.149604Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-17T18:25:25.277Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/vxcan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6d6dcf2399cdd26f7f5426ca8dd8366b7f2ca105",
              "status": "affected",
              "version": "a8f820a380a2a06fc4fe1a54159067958f800929",
              "versionType": "git"
            },
            {
              "lessThan": "9b820875a32a3443d67bfd368e93038354e98052",
              "status": "affected",
              "version": "a8f820a380a2a06fc4fe1a54159067958f800929",
              "versionType": "git"
            },
            {
              "lessThan": "a24476b37167816e6352ca1a2cf3769847774f70",
              "status": "affected",
              "version": "a8f820a380a2a06fc4fe1a54159067958f800929",
              "versionType": "git"
            },
            {
              "lessThan": "e771a874076115df8bff27d325edfd2340e4ec69",
              "status": "affected",
              "version": "a8f820a380a2a06fc4fe1a54159067958f800929",
              "versionType": "git"
            },
            {
              "lessThan": "75854cad5d80976f6ea0f0431f8cedd3bcc475cb",
              "status": "affected",
              "version": "a8f820a380a2a06fc4fe1a54159067958f800929",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/vxcan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.218",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.171",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.218",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.171",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.93",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.11",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.11",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: vxcan: vxcan_xmit: fix use after free bug\n\nAfter calling netif_rx_ni(skb), dereferencing skb is unsafe.\nEspecially, the canfd_frame cfd which aliases skb memory is accessed\nafter the netif_rx_ni()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in vxcan_xmit, reached by sending a CAN frame on a virtual vxcan interface via PF_CAN/SOCK_RAW and RTNL setup\u2014local syscalls/netlink only, not remote packet processing.\nAC:L - netif_rx_ni() runs softirq immediately and can_receive() always consume_skb()s the delivered frame, so the post-rx cfd-\u003elen access is a reliable use-after-free with no race or uncontrolled condition.\nPR:L - Creating/bringing up vxcan requires CAP_NET_ADMIN, which an unprivileged user obtains via user+network namespaces (unshare -Urn); sending on an existing up interface needs no capability.\nUI:N - The attacker creates the vxcan pair, brings it up, and sends frames entirely on their own\u2014no victim interaction is required.\nS:U - Impact is confined to the local kernel (memory corruption / privilege escalation within the same security authority); this is not a VM/IOMMU/sandbox boundary escape.\nC:H - This is a use-after-free of skb data after delivery; a dangling read of freed heap enables disclosure of reclaimed object contents (including via stats that incorporate the stale byte).\nI:H - Use-after-free of the skb data buffer is exploitable via heap reuse/spray for corruption and control-flow hijacking primitives beyond the immediate stats update.\nA:H - Dereferencing freed skb data can oops/panic the kernel when the page is reclaimed or unmapped, and UAF faults are reliably triggerable on the success path."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:48:49.266Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6d6dcf2399cdd26f7f5426ca8dd8366b7f2ca105"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b820875a32a3443d67bfd368e93038354e98052"
        },
        {
          "url": "https://git.kernel.org/stable/c/a24476b37167816e6352ca1a2cf3769847774f70"
        },
        {
          "url": "https://git.kernel.org/stable/c/e771a874076115df8bff27d325edfd2340e4ec69"
        },
        {
          "url": "https://git.kernel.org/stable/c/75854cad5d80976f6ea0f0431f8cedd3bcc475cb"
        }
      ],
      "title": "can: vxcan: vxcan_xmit: fix use after free bug",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47669",
    "datePublished": "2025-04-17T18:01:29.979Z",
    "dateReserved": "2025-04-16T07:16:05.752Z",
    "dateUpdated": "2026-08-05T08:48:49.266Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-integrity.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6a95d91c0b315c965198f6ab7dec7c94129e17e0",
              "status": "affected",
              "version": "a3fcf7253139609bf9ff901fbf955fba047e75dd",
              "versionType": "git"
            },
            {
              "lessThan": "7f84c937222944c03f4615ca4742df6bed0e5adf",
              "status": "affected",
              "version": "a3fcf7253139609bf9ff901fbf955fba047e75dd",
              "versionType": "git"
            },
            {
              "lessThan": "cd02b2687d66f0a8e716384de4b9a0671331f1dc",
              "status": "affected",
              "version": "a3fcf7253139609bf9ff901fbf955fba047e75dd",
              "versionType": "git"
            },
            {
              "lessThan": "6b4bf97587ef6c1927a78934b700204920655123",
              "status": "affected",
              "version": "a3fcf7253139609bf9ff901fbf955fba047e75dd",
              "versionType": "git"
            },
            {
              "lessThan": "4d485cf9b609709e45d5113e6e2b1b01254b2fe9",
              "status": "affected",
              "version": "a3fcf7253139609bf9ff901fbf955fba047e75dd",
              "versionType": "git"
            },
            {
              "lessThan": "08c1af8f1c13bbf210f1760132f4df24d0ed46d6",
              "status": "affected",
              "version": "a3fcf7253139609bf9ff901fbf955fba047e75dd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-integrity.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "lessThan": "4.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.240",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.240",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.190",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.112",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.35",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.4",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm integrity: fix memory corruption when tag_size is less than digest size\n\nIt is possible to set up dm-integrity in such a way that the\n\"tag_size\" parameter is less than the actual digest size. In this\nsituation, a part of the digest beyond tag_size is ignored.\n\nIn this case, dm-integrity would write beyond the end of the\nic-\u003erecalc_tags array and corrupt memory. The corruption happened in\nintegrity_recalc-\u003eintegrity_sector_checksum-\u003ecrypto_shash_final.\n\nFix this corruption by increasing the tags array so that it has enough\npadding at the end to accomodate the loop in integrity_recalc() being\nable to write a full digest size for the last member of the tags\narray."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T23:57:25.025Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6a95d91c0b315c965198f6ab7dec7c94129e17e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/7f84c937222944c03f4615ca4742df6bed0e5adf"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd02b2687d66f0a8e716384de4b9a0671331f1dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b4bf97587ef6c1927a78934b700204920655123"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d485cf9b609709e45d5113e6e2b1b01254b2fe9"
        },
        {
          "url": "https://git.kernel.org/stable/c/08c1af8f1c13bbf210f1760132f4df24d0ed46d6"
        }
      ],
      "title": "dm integrity: fix memory corruption when tag_size is less than digest size",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49044",
    "datePublished": "2025-02-26T01:54:21.389Z",
    "dateReserved": "2025-02-26T01:49:39.241Z",
    "dateUpdated": "2026-08-12T23:57:25.025Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}