CVE-2025-21775

In the Linux kernel, the following vulnerability has been resolved:

can: ctucanfd: handle skb allocation failure

If skb allocation fails, the pointer to struct can_frame is NULL. This
is actually handled everywhere inside ctucan_err_interrupt() except for
the only place.

Add the missed NULL check.

Found by Linux Verification Center (linuxtesting.org) with SVACE static
analysis tool.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.5 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
LinuxCNA
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 2%
VendorProductVersion
linuxlinux_kernel
5.19 ≤
𝑥
< 6.1.129
linuxlinux_kernel
6.2 ≤
𝑥
< 6.6.79
linuxlinux_kernel
6.7 ≤
𝑥
< 6.12.16
linuxlinux_kernel
6.13 ≤
𝑥
< 6.13.4
linuxlinux_kernel
6.14:rc1
linuxlinux_kernel
6.14:rc2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
linux
bullseye
5.10.223-1
not-affected
bullseye (security)
5.10.234-1
fixed
bookworm
6.1.129-1
fixed
bookworm (security)
vulnerable
trixie
6.12.20-1
fixed
sid
6.12.21-1
fixed
linux-6.1
bullseye (security)
6.1.129-1~deb11u1
fixed
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://git.kernel.org/stable/c/84b9ac59978a6a4e0812d1c938fad97306272cef
https://git.kernel.org/stable/c/9bd24927e3eeb85642c7baa3b28be8bea6c2a078
https://git.kernel.org/stable/c/b0e592dd46a0a952b41c3bf6c963afdd6a42b526
https://git.kernel.org/stable/c/e505b83b9ee6aa0ae2f4395f573a66579ae403fb
https://git.kernel.org/stable/c/e7e2e2318b1f085044126ba553a4e619842fc36d