PT-2026-34658 · Linux+1 · Linux Kernel+1
Published
2026-04-23
·
Updated
2026-06-11
·
CVE-2026-31532
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A race condition exists in the SocketCAN subsystem of the Linux kernel. The
raw release() function unregisters raw CAN receive filters through can rx unregister(), but the deletion of the receiver is deferred using call rcu(). This creates a timing window where the raw rcv() function may still be executing within an RCU read-side critical section after raw release() has already freed ro->uniq, resulting in a use-after-free of the percpu uniq storage.Recommendations
Move the
free percpu(ro->uniq) call from raw release() to a raw-specific socket destructor. This ensures that the percpu area is not released until the relevant callbacks have drained, as can rx unregister() maintains an extra reference to the socket that is only dropped from the RCU callback, allowing sk destruct to handle the freeing of uniq safely.Fix
DoS
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linux Kernel
Rocky Linux