CVE-2022-49275

A flaw was found in the Linux kernel. A use-after-free vulnerability exists in the Controller Area Network (CAN) Bosch M_CAN driver when transmitting packets, where a socket buffer is freed prematurely during transmission handling. A local attacker could exploit this vulnerability to cause a system crash resulting in a denial of service (DoS) or potentially execute arbitrary code.

This vulnerability is assessed as Moderate impact because exploitation requires local access on a system configured with Bosch M_CAN hardware or virtual interfaces, restricting the blast radius to specialized automotive and industrial deployments. On standard Red Hat Enterprise Linux installations, CAN interfaces and the associated drivers are neither enabled nor utilized by default. While an attacker with local privileges could trigger a kernel use-after-free condition during packet transmission to cause a denial of service, typical server and enterprise deployments do not expose the required hardware controllers.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.