LiveActive security incident?Get immediate response
CVE Record

CVE-2025-39873: can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB

In the Linux kernel, the following vulnerability has been resolved: can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB can_put_echo_skb() takes ownership of the SKB and it may be freed during or after the call. However, xilinx_can xcan_write_frame() keeps using SKB after the call. Fix that by only calling can_put_echo_skb() after the code is done touching the SKB. The tx_lock is held for the entire xcan_write_frame() execution and also on the can_get_echo_skb() side so the order of operations does not matter. An earlier fix commit 3d3c817c3a40 ("can: xilinx_can: Fix usage of skb memory") did not move the can_put_echo_skb() call far enough. [mkl: add "commit" in front of sha1 in patch description] [mkl: fix indention]

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A flaw in the Linux Xilinx CAN driver can access a transmitted network buffer after ownership has transferred and the buffer may have been freed. This kernel memory-safety error could compromise confidentiality, integrity, or availability when the affected transmit path is reached.

Executive priority

Treat this as a high-priority maintenance issue for operational, embedded, or industrial systems using Xilinx CAN. Accelerate patching where untrusted local users or workloads exist. Systems without the affected driver or transmit path are lower priority, subject to confirmation through inventory.

Technical view

In xcan_write_frame(), can_put_echo_skb() transfers ownership of the SKB and may free it, but later code continued using that SKB. The correction moves can_put_echo_skb() until after all SKB access. The existing transmit lock also protects the echo-consumption side. An earlier attempted fix did not move the call far enough.

Likely exposure

Exposure is limited to systems running an affected Linux kernel where the Xilinx CAN driver and its transmission path are used. The supplied data identifies affected releases through 6.17, but commit-based version entries are ambiguous; distribution backports may change whether a specific kernel build is vulnerable.

Exploitation context

The supplied CVSS vector describes local access, low privileges, low complexity, and no user interaction. The CVE is not listed as KEV, and the sources provide no evidence of active exploitation or a public exploit. Practical exploitability and reliable impact are not established by this bundle.

Researcher notes

The vulnerable sequence is an ownership-lifetime error involving an SKB after can_put_echo_skb(). The patch changes call ordering rather than locking because tx_lock already spans xcan_write_frame() and the echo retrieval side. Source history explicitly says commit 3d3c817c3a40 was incomplete. No CWE was supplied.

Mitigation direction

  • Install a vendor-supported kernel update that incorporates the applicable stable fix.
  • Confirm distribution backports against the referenced kernel commits, not version numbers alone.
  • If updating is delayed, consult the kernel or distribution vendor for supported interim guidance.
  • Prioritize systems actively using Xilinx CAN transmission interfaces.

Validation and detection

  • Inventory running kernel builds and identify systems using the Xilinx CAN driver.
  • Check vendor advisories or package changelogs for an explicit CVE fix or referenced commit.
  • Verify the installed kernel after reboot, not only the downloaded package version.
  • After remediation, validate normal CAN transmission and review kernel logs for memory or driver errors.
Prepared
Confidence
high
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-39873 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
8Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-39873Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux1598efe57b3e768056e4ca56cb9cf33111e68d1c, 1598efe57b3e768056e4ca56cb9cf33111e68d1c, 1598efe57b3e768056e4ca56cb9cf33111e68d1c, 1598efe57b3e768056e4ca56cb9cf33111e68d1c, 1598efe57b3e768056e4ca56cb9cf33111e68d1c, 1598efe57b3e768056e4ca56cb9cf33111e68d1cunaffected
LinuxLinux4.19, 0, 5.15.194, 6.1.153, 6.6.107, 6.12.48, 6.16.8, 6.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.