PT-2026-34658 · Linux · Linux

Published 2026-04-23 · Updated 2026-04-23 · CVE-2026-31532

Mitre

In the Linux kernel, the following vulnerability has been resolved:

can: raw: fix ro->uniq use-after-free in raw rcv()

raw release() unregisters raw CAN receive filters via can rx unregister(), but receiver deletion is deferred with call rcu(). This leaves a window where raw rcv() may still be running in an RCU read-side critical section after raw release() frees ro->uniq, leading to a use-after-free of the percpu uniq storage.

Move free percpu(ro->uniq) out of raw release() and into a raw-specific socket destructor. can rx unregister() takes an extra reference to the socket and only drops it from the RCU callback, so freeing uniq from sk destruct ensures the percpu area is not released until the relevant callbacks have drained.

[mkl: applied manually]

Related Identifiers

CVE-2026-31532

Affected Products

Linux

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-31532 · Security Note
• https://git.kernel.org/stable/c/1a0f2de81f7fbdc538fc72d7d74609b79bc83cc0 · Note
• https://git.kernel.org/stable/c/572f0bf536ebc14f6e7da3d21a85cf076de8358e · Note
• https://git.kernel.org/stable/c/34c1741254ff972e8375faf176678a248826fe3a · Note
• https://git.kernel.org/stable/c/7201a531b9a5ed892bfda5ded9194ef622de8ffa · Note