CVE-2025-21775

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-21775
In the Linux kernel, the following vulnerability has been resolved: can: ctucanfd: handle skb allocation failure If skb allocation fails, the pointer to struct can_frame is NULL. This is actually handled everywhere inside ctucan_err_interrupt() except for the only place. Add the missed NULL check. Found by Linux Verification Center (linuxtesting.org) with SVACE static analysis tool.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/84b9ac59978a6a4e0812d1c938fad97306272cef Patch
https://git.kernel.org/stable/c/9bd24927e3eeb85642c7baa3b28be8bea6c2a078 Patch
https://git.kernel.org/stable/c/b0e592dd46a0a952b41c3bf6c963afdd6a42b526 Patch
https://git.kernel.org/stable/c/e505b83b9ee6aa0ae2f4395f573a66579ae403fb Patch
https://git.kernel.org/stable/c/e7e2e2318b1f085044126ba553a4e619842fc36d Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
History

05 Mar 2025, 18:47

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/84b9ac59978a6a4e0812d1c938fad97306272cef - () https://git.kernel.org/stable/c/84b9ac59978a6a4e0812d1c938fad97306272cef - Patch
References () https://git.kernel.org/stable/c/9bd24927e3eeb85642c7baa3b28be8bea6c2a078 - () https://git.kernel.org/stable/c/9bd24927e3eeb85642c7baa3b28be8bea6c2a078 - Patch
References () https://git.kernel.org/stable/c/b0e592dd46a0a952b41c3bf6c963afdd6a42b526 - () https://git.kernel.org/stable/c/b0e592dd46a0a952b41c3bf6c963afdd6a42b526 - Patch
References () https://git.kernel.org/stable/c/e505b83b9ee6aa0ae2f4395f573a66579ae403fb - () https://git.kernel.org/stable/c/e505b83b9ee6aa0ae2f4395f573a66579ae403fb - Patch
References () https://git.kernel.org/stable/c/e7e2e2318b1f085044126ba553a4e619842fc36d - () https://git.kernel.org/stable/c/e7e2e2318b1f085044126ba553a4e619842fc36d - Patch
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
CWE CWE-476
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: can: ctucanfd: manejar la falla de asignación de skb Si la asignación de skb falla, el puntero a struct can_frame es NULL. Esto se maneja en realidad en todas partes dentro de ctucan_err_interrupt() excepto en el único lugar. Agregue la verificación NULL omitida. Encontrado por Linux Verification Center (linuxtesting.org) con la herramienta de análisis estático SVACE.
First Time Linux linux Kernel
Linux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

27 Feb 2025, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-27 03:15

Updated : 2025-10-01 20:18

NVD link : CVE-2025-21775

Mitre link : CVE-2025-21775

CVE.ORG link : CVE-2025-21775

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference