Security readout for executives and security teams
Plain-English summary
This is a Linux kernel memory safety flaw in the PEAK PCI CAN driver. When the driver is removed, it can use memory after it has already been freed. On systems using this driver, the impact could be serious, but the evidence provided points to local driver removal behavior, not internet-facing exploitation.
Executive priority
Treat this as a targeted high-priority kernel update for systems using PEAK PCI CAN functionality. It is less likely to be a broad enterprise emergency unless those drivers are deployed, but affected operational or embedded systems should be patched promptly through normal kernel maintenance channels.
Technical view
CVE-2021-47456 is a use-after-free in Linux kernel peak_pci_remove() for the CAN peak_pci driver. The provided KASAN trace shows peak_pci_remove() reading a freed chan-related object after dev was released. The fix changes cleanup ordering so dev is released later.
Likely exposure
Exposure is most likely on Linux systems with the PEAK PCI CAN driver present and reachable through device or module removal paths. This is especially relevant to industrial, automotive, embedded, or lab systems using PEAK-System CAN PCI hardware. Generic Linux servers without this driver or hardware are less likely exposed.
Exploitation context
The bundle reports CVSS 8.4 with local attack vector and no privileges required. It does not cite CISA KEV listing or other evidence of active exploitation. The available evidence supports a serious local kernel memory-corruption risk, not confirmed in-the-wild exploitation.
Researcher notes
Evidence is limited to the CVE record description, CVSS, affected Linux version data, and kernel stable references. The trigger is driver removal cleanup, with KASAN confirming a use-after-free. No exploit details, exploit maturity, or distribution-specific fixed package versions are provided in the source bundle.
Mitigation direction
- Update affected Linux kernels to vendor-supported builds containing the referenced stable fixes.
- Prioritize systems using PEAK PCI CAN hardware or loading the peak_pci driver.
- If immediate patching is unavailable, check Linux distribution guidance for supported mitigations.
- Limit local access to systems where the affected driver is present.
- Avoid ad hoc kernel or module changes outside vendor-supported maintenance procedures.
Validation and detection
- Inventory systems for Linux kernels in the affected version ranges from the CVE record.
- Check whether the peak_pci driver is built, installed, or loaded.
- Confirm installed kernel packages include the relevant stable fix commits or vendor backports.
- Review distribution advisories for CVE-2021-47456 applicability to shipped kernels.
- Validate remediation in staging before production rollout on CAN-connected systems.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-467: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-47456 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.55.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
8.4HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/1c616528ba4aeb1125a06b407572ab7b56acae38CVE reference, Linux
- https://git.kernel.org/stable/c/447d44cd2f67a20b596ede3ca3cd67086dfd9ca9CVE reference, Linux
- https://git.kernel.org/stable/c/34914971bb3244db4ce2be44e9438a9b30c56250CVE reference, Linux
- https://git.kernel.org/stable/c/adbda14730aacce41c0d3596415aa39ad63eafd9CVE reference, Linux
- https://git.kernel.org/stable/c/1248582e47a9f7ce0ecd156c39fc61f8b6aa3699CVE reference, Linux
- https://git.kernel.org/stable/c/28f28e4bc3a5e0051faa963f10b778ab38c1db69CVE reference, Linux
- https://git.kernel.org/stable/c/0e5afdc2315b0737edcf55bede4ee1640d2d464dCVE reference, Linux
- https://git.kernel.org/stable/c/949fe9b35570361bc6ee2652f89a0561b26eec98CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Use of sizeof() on a Pointer Type
Use of sizeof() on a Pointer Type represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.