CVE-2021-47232

A flaw was found in the Linux kernel's Controller Area Network (CAN) J1939 implementation. This vulnerability allows a local user to cause a denial of service (DoS) through a system crash. The issue occurs because network socket buffers are retrieved from a session queue without incrementing their reference count, resulting in a use-after-free condition during concurrent operations.

This vulnerability is rated as having a Low impact because the Controller Area Network (CAN) J1939 protocol stack is not loaded by default and is typically unused in standard enterprise server environments. Exploitation requires local system access to interact with the CAN subsystem, limiting the blast radius to a denial of service (system crash) through a kernel use-after-free condition. Typical Red Hat Enterprise Linux deployments do not configure or expose CAN hardware or interfaces, significantly reducing exposure under default configurations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.