Security readout for executives and security teams
Plain-English summary
This is a Linux kernel use-after-free in CAN network device restart handling. A local user could potentially cause serious confidentiality, integrity, or availability impact on affected systems. The business concern is highest for Linux systems using CAN, such as embedded, automotive, industrial, or lab environments.
Executive priority
Treat as high priority where Linux systems use CAN or allow untrusted local users. For general servers without CAN exposure, validate applicability first, then patch through normal kernel security maintenance.
Technical view
The flaw is in can_restart. After netif_rx_ni(skb), the skb memory may no longer be safe to dereference, but the code still reads the aliased can_frame length for rx_bytes. The fix reorders accounting before handing off the skb.
Likely exposure
Exposure appears limited to affected Linux kernels where the CAN networking subsystem is present and reachable by a local authenticated user. The source bundle lists Linux kernel versions and stable fix commits, but affected-range detail is not fully normalized here.
Exploitation context
The CVSS vector is local, low complexity, low privilege, no user interaction, with high confidentiality, integrity, and availability impact. The source bundle says KEV is false and provides no evidence of active exploitation.
Researcher notes
The root issue is a lifetime bug: cf aliases skb memory after netif_rx_ni(skb). Avoid inferring remote exploitability; the provided vector is local. The listed version data is hard to interpret, so verify against kernel stable commits and distribution backports.
Mitigation direction
- Apply vendor or distribution kernel updates that include the referenced stable fixes.
- Prioritize CAN-enabled embedded, automotive, industrial, and multi-user Linux systems.
- Restrict local shell access and CAN interface access until patched.
- Check vendor guidance for exact affected kernel package mappings.
Validation and detection
- Inventory Linux kernel versions across servers, images, appliances, and embedded devices.
- Identify hosts with CAN networking support enabled or CAN hardware attached.
- Confirm whether installed vendor kernels include the can_restart use-after-free fix.
- Track remediation through distribution security advisories and kernel package changelogs.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-47668 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/260925a0b7d2da5449f8ecfd02c1405e0c8a45b8CVE reference, Linux
- https://git.kernel.org/stable/c/bbc6847b9b8978b520f62fbc7c68c54ef0f8d282CVE reference, Linux
- https://git.kernel.org/stable/c/92668d28c7e6a7a2ba07df287669ffcdf650c421CVE reference, Linux
- https://git.kernel.org/stable/c/08ab951787098ae0b6c0364aeea7a8138226f234CVE reference, Linux
- https://git.kernel.org/stable/c/ac48ef15826e83f4206c47add61072e8fc76d328CVE reference, Linux
- https://git.kernel.org/stable/c/593c072b7b3c4d7044416eb039d9ad706bedd67aCVE reference, Linux
- https://git.kernel.org/stable/c/03f16c5075b22c8902d2af739969e878b0879c94CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.