CVE-2021-47670

In the Linux kernel, the following vulnerability has been resolved:

can: peak_usb: fix use after free bugs

After calling peak_usb_netif_rx_ni(skb), dereferencing skb is unsafe. Especially, the can_frame cf which aliases skb memory is accessed after the peak_usb_netif_rx_ni().

Reordering the lines solves the issue.

An unprivileged user with device access could potentially trigger a use-after-free vulnerability. However, this would require them to interact with the CAN device in a highly specific and difficult-to-automate manner to create the necessary conditions within the kernel driver.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.