CVE-2022-49008

What it actually does

The can327_feed_frame_to_netdev function fails to release an allocated skb when the associated network device is down, and callers likewise omit the free, resulting in a memory leak.

Why it matters to the business

Systems that rely on the CAN-over-serial driver may experience gradual memory exhaustion, leading to reduced stability or unexpected reboots on long-running embedded or automotive Linux deployments.

How an attack unfolds

An attacker with the ability to inject CAN frames into a can327 interface can trigger repeated skb allocations that are never freed while the net device remains administratively down, slowly depleting kernel memory until the system becomes unresponsive.

How to fix it

Update the Linux kernel to a version containing commit 797b1d9fc0e1f4351e4ad49b078c1a3cdc0d4a08 (or the equivalent fix 211dfe9ebf1c6618ce5396b0338de4f9b580715e) and reboot affected systems.

How to confirm the fix worked

Confirm the running kernel contains the listed commit hashes via git describe or kernel version string, then exercise can327 interfaces while the netdev is down and verify no skb leaks appear in /proc/slabinfo or kmemleak reports.

Typical attack path

1. Obtain local or physical access to a target running a vulnerable Linux kernel with the can327 driver enabled.
2. Configure or observe the CAN interface in a down state.
3. Inject CAN frames at a sustained rate to trigger repeated allocations without corresponding frees.
4. Monitor system memory until exhaustion causes denial of service.

How to detect it

Review kernel logs for repeated can327 activity while the interface is down and inspect slab or kmemleak output for growing skb allocations; correlate with process or driver load patterns.

What your security team should do

• Prioritize patching any production kernels that include the can327 driver within the next maintenance window.
• Disable the can327 module if CAN-over-serial functionality is not required.
• Monitor memory usage on systems that cannot be immediately updated.