Security readout for executives and security teams
Plain-English summary
This Linux kernel issue is a use-after-free bug in the peak_usb CAN driver path. A local low-privileged user could potentially trigger memory corruption with high impact to confidentiality, integrity, and availability. The provided sources show kernel stable fixes but no evidence of known active exploitation.
Executive priority
Treat as high priority for Linux systems using CAN/USB interfaces, especially engineering, industrial, automotive, or embedded environments. It is less urgent for systems without the affected driver path, but patch governance should still track kernel vendor fixes.
Technical view
After peak_usb_netif_rx_ni(skb), code continued dereferencing skb-backed memory through can_frame cf. The fix reorders operations so skb-derived data is not accessed after ownership/lifetime may have changed. The CVE is classified as CWE-416 with CVSS 3.1 score 7.8, local attack vector, low privileges required.
Likely exposure
Exposure appears limited to Linux kernels in the affected ranges where the peak_usb CAN driver is present or used. This is not described as remotely exploitable in the provided CVSS vector; it requires local access with low privileges.
Exploitation context
The source bundle marks KEV as false and provides no cited evidence of active exploitation or public weaponization. Risk comes from local kernel memory corruption potential and high CVSS impact, not from confirmed exploitation activity.
Researcher notes
The evidence is strongest on root cause and fix direction, but incomplete on exploitability in real deployments. Avoid assuming affected hardware scope beyond the Linux peak_usb driver context. Validate using kernel version, distro backports, and driver presence rather than CVE version strings alone.
Mitigation direction
- Update affected Linux kernels through vendor-supported kernel packages.
- Confirm the update includes the referenced stable kernel fixes.
- Check distribution advisories for backported fixes and exact package versions.
- Disable or avoid peak_usb CAN driver use where operationally safe until patched.
Validation and detection
- Inventory Linux hosts using affected kernel versions or backported equivalents.
- Identify systems where the peak_usb CAN driver is loaded or required.
- Verify installed kernel packages include vendor fixes for CVE-2021-47670.
- Review change control for CAN-connected or embedded Linux systems.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-47670 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/5408824636fa0dfedb9ecb0d94abd573131bfbbeCVE reference, Linux
- https://git.kernel.org/stable/c/ddd1416f44130377798c1430b76503513b7497c2CVE reference, Linux
- https://git.kernel.org/stable/c/ec939c13c3fff2114479769c8380b7f1a54feca9CVE reference, Linux
- https://git.kernel.org/stable/c/50aca891d7a554db0901b245167cd653d73aaa71CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.