Description
In the Linux kernel 5.11 through 5.12.2, isotp_setsockopt in net/can/isotp.c allows privilege escalation to root by leveraging a use-after-free. (This does not affect earlier versions that lack CAN ISOTP SF_BROADCAST support.)
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | linux-riscv +1 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp +13 | No fix yet | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | kernel-source | 5.14.6-1.4 | openSUSE-SU-2024:13704-1, openSUSE-SU-2024:10728-1 |
Advisories 3
- openSUSE-SU-2024:13704-1 kernel-devel-longterm-6.6.17-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10728-1 kernel-devel-5.14.6-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2022-2068 Linux Kernel: Mehrere Schwachstellen ermöglichen Privilegieneskalation BSI CERT-Bund (WID) · Aug 19, 2024
References
- https://www.openwall.com/lists/oss-security/2021/05/11/16
- [oss-security] 20210512 Re: Linux kernel: net/can/isotp: race condition leads to local privilege escalation mailing-list
- [oss-security] 20210514 Re: Linux kernel: net/can/isotp: race condition leads to local privilege escalation mailing-list
- [oss-security] 20210514 Re: Linux kernel: net/can/isotp: race condition leads to local privilege escalation mailing-list
- FEDORA-2021-4f852b79d1 vendor-advisory
- FEDORA-2021-bae582b42c vendor-advisory
- FEDORA-2021-8832eab899 vendor-advisory
- [oss-security] 20210528 Re: Linux kernel: net/can/isotp: race condition leads to local privilege escalation mailing-list
- https://security.netapp.com/advisory/ntap-20210625-0001/
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2b17c400aeb44daf041627722581ade527bb3c1d