CVE-2025-21775: can: ctucanfd: handle skb allocation failure
In the Linux kernel, the following vulnerability has been resolved:
can: ctucanfd: handle skb allocation failure
If skb allocation fails, the pointer to struct canframe is NULL. This is actually handled everywhere inside ctucanerrinterrupt() except for the only place.
Add the missed NULL check.
Found by Linux Verification Center (linuxtesting.org) with SVACE static analysis tool.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Add the missing NULL check in the Linux kernel can: ctucanfd code to handle skb allocation failure before dereferencing the struct can_frame pointer in ctucan_err_interrupt().
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21775?
CVE-2025-21775 has been classified with a severity level that indicates potential impact on the Linux kernel due to handling skb allocation failures.
How do I fix CVE-2025-21775?
To fix CVE-2025-21775, ensure that you are running an updated version of the Linux kernel where this vulnerability has been patched.
Which versions of the Linux kernel are affected by CVE-2025-21775?
CVE-2025-21775 affects Linux kernel versions between 5.19 and 6.1.129, as well as several other specified versions up to 6.14-rc2.
What components of the Linux kernel are impacted by CVE-2025-21775?
CVE-2025-21775 specifically impacts the 'can: ctucanfd' component related to handling skb allocation failures in the Linux kernel.
Is CVE-2025-21775 actively being exploited?
As of the current date, there is no public information indicating that CVE-2025-21775 is actively being exploited.