CVE-2021-47232
A critical use‑after‑free bug in the Linux kernel’s CAN J1939 driver could let attackers crash the system or potentially execute code. The flaw occurs when a network packet buffer is released without a reference count, allowing it to be freed while still in use. The issue has been fixed in recent kernel releases.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel users, especially those running kernel 5.13 or earlier.
Real-world impact
An attacker could crash the system or potentially execute code by exploiting the use‑after‑free in the CAN J1939 driver.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability can be exploited remotely without authentication or user interaction, and it can compromise confidentiality, integrity, and availability.
What to do about it
- 01Upgrade the Linux kernel to version 5.13 or later.
- 02Reboot the system to load the updated kernel.
NVD description
Timeline
- May 21, 2024 · May 21, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 5, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.