SECUFOCUSNOW
Home›CVE index›CVE-2025-39873
Review reviewHigh

CVE-2025-39873

Linux Linux, linux kernel, debian linux

In the Linux kernel, the following vulnerability has been resolved: can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB can_put_echo_skb() takes ownership of the SKB and it may be freed during or after the call. However, xilinx_can xcan_write_frame() keeps using SKB after the call. Fix that by only calling can_put_echo_skb() after the code is done touching the SKB. The tx_lock is held for the entire xcan_write_frame() execution and also on the can_get_echo_skb() side so the order of operations does not matter. An earlier fix commit 3d3c817c3a40 ("can: xilinx_can: Fix...

CVSS
7.8
EPSS
0.15%
4.47% percentile
CISA KEV
Not listed
Published
2025.09.23
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.15%
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB can_put_echo_skb() takes ownership of the SKB and it may be freed during or after the call. However, xilinx_can xcan_write_frame() keeps using SKB after the call. Fix that by only calling can_put_echo_skb() after the code is done touching the SKB. The tx_lock is held for the entire xcan_write_frame() execution and also on the can_get_echo_skb() side so the order of operations does not matter. An earlier fix commit 3d3c817c3a40 ("can: xilinx_can: Fix...

Affected product and versions

Product
Linux Linux, linux kernel, debian linux
Affected versions
>= 1598efe57b3e768056e4ca56cb9cf33111e68d1c < e202ffd9e54538ef67ec301ebd6d9da4823466c9, >= 1598efe57b3e768056e4ca56cb9cf33111e68d1c < 1139321161a3ba5e45e61e0738b37f42f20bc57a, >= 1598efe57b3e768056e4ca56cb9cf33111e68d1c < 94b050726288a56a6b8ff55aa641f2fedbd3b44c, >= 1598efe57b3e768056e4ca56cb9cf33111e68d1c < 725b33deebd6e4c96fe7893f384510a54258f28f, >= 1598efe57b3e768056e4ca56cb9cf33111e68d1c < 668cc1e3bb21101d074e430de1b7ba8fd10189e7, >= 1598efe57b3e768056e4ca56cb9cf33111e68d1c < ef79f00be72bd81d2e1e6f060d83cf7e425deee4, >= 4.19, >= 4.19 < 5.15.194, >= 5.16 < 6.1.153, >= 6.2 < 6.6.107, >= 6.7 < 6.12.48, >= 6.13 < 6.16.8, 6.17, 11.0
Fixed versions
5.15.194, 6.1.153, 6.6.107, 6.12.48, 6.16.8

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, linux kernel, debian linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-416
CVE-2025-39873 — Linux Linux, linux kernel, debian linux | SECUFOCUS NOW