1. Home
  2. Vulnerabilities
  3. CVE-2025-39873
0.0
NA
CVE-2025-39873
can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB
Description

In the Linux kernel, the following vulnerability has been resolved: can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB can_put_echo_skb() takes ownership of the SKB and it may be freed during or after the call. However, xilinx_can xcan_write_frame() keeps using SKB after the call. Fix that by only calling can_put_echo_skb() after the code is done touching the SKB. The tx_lock is held for the entire xcan_write_frame() execution and also on the can_get_echo_skb() side so the order of operations does not matter. An earlier fix commit 3d3c817c3a40 ("can: xilinx_can: Fix usage of skb memory") did not move the can_put_echo_skb() call far enough. [mkl: add "commit" in front of sha1 in patch description] [mkl: fix indention]

INFO

Published Date :

Sept. 23, 2025, 6:15 a.m.

Last Modified :

Sept. 23, 2025, 6:15 a.m.

Remotely Exploit :

No

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products

The following products are affected by CVE-2025-39873 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

No affected product recoded yet

: Total Affected Vendor : 0 | Products : 0
Solution
Apply kernel patches to fix a use-after-free vulnerability in the Xilinx CAN driver.
  • Update the Linux kernel to include the fix.
  • Ensure the Xilinx CAN driver is correctly patched.
  • Apply relevant security updates to the system.
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-39873.

URL Resource
https://git.kernel.org/stable/c/1139321161a3ba5e45e61e0738b37f42f20bc57a
https://git.kernel.org/stable/c/668cc1e3bb21101d074e430de1b7ba8fd10189e7
https://git.kernel.org/stable/c/725b33deebd6e4c96fe7893f384510a54258f28f
https://git.kernel.org/stable/c/94b050726288a56a6b8ff55aa641f2fedbd3b44c
https://git.kernel.org/stable/c/ef79f00be72bd81d2e1e6f060d83cf7e425deee4
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-39873 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-39873 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-39873 vulnerability anywhere in the article.

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2025-39873 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Sep. 23, 2025

    Action Type Old Value New Value
    Added Description In the Linux kernel, the following vulnerability has been resolved: can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB can_put_echo_skb() takes ownership of the SKB and it may be freed during or after the call. However, xilinx_can xcan_write_frame() keeps using SKB after the call. Fix that by only calling can_put_echo_skb() after the code is done touching the SKB. The tx_lock is held for the entire xcan_write_frame() execution and also on the can_get_echo_skb() side so the order of operations does not matter. An earlier fix commit 3d3c817c3a40 ("can: xilinx_can: Fix usage of skb memory") did not move the can_put_echo_skb() call far enough. [mkl: add "commit" in front of sha1 in patch description] [mkl: fix indention]
    Added Reference https://git.kernel.org/stable/c/1139321161a3ba5e45e61e0738b37f42f20bc57a
    Added Reference https://git.kernel.org/stable/c/668cc1e3bb21101d074e430de1b7ba8fd10189e7
    Added Reference https://git.kernel.org/stable/c/725b33deebd6e4c96fe7893f384510a54258f28f
    Added Reference https://git.kernel.org/stable/c/94b050726288a56a6b8ff55aa641f2fedbd3b44c
    Added Reference https://git.kernel.org/stable/c/ef79f00be72bd81d2e1e6f060d83cf7e425deee4
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
Vulnerability Scoring Details
No CVSS metrics available for this vulnerability.