CVE-2021-47669: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47669 is a use-after-free vulnerability discovered in the Linux kernel's Virtual CAN (vxcan) network driver implementation. The vulnerability was disclosed on April 17, 2025, affecting multiple versions of the Linux kernel from 4.12 through 5.11-rc4 (NVD).

The vulnerability occurs in the vxcanxmit function where after calling netifrxni(skb), the code continues to dereference the skb pointer, which is unsafe. Specifically, the canfdframe cfd which aliases skb memory is accessed after the netifrxni() call. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H and is classified as CWE-416 (Use After Free) (NVD).

The vulnerability affects multiple versions of the Linux kernel, including versions from 4.12 to 4.14.218, 4.15 to 4.19.171, 4.20 to 5.4.93, and 5.5 to 5.10.11. This use-after-free bug could potentially lead to high impacts on confidentiality, integrity, and availability of the affected systems (NVD).

Multiple patches have been released to address this vulnerability across different kernel versions. Fixed versions are available in various Linux distributions, including Debian Bullseye (5.10.234-1), Bookworm (6.1.133-1), and Trixie (6.12.22-1) (Debian).