Executive brief
A vulnerability in the Linux kernel's CAN (Controller Area Network) networking subsystem could allow a local user to crash the system or potentially execute unauthorized code. The issue occurs when the system incorrectly manages memory while closing certain types of network connections used in automotive and industrial environments. This could lead to system instability or a complete service outage.
Technical details
A use-after-free vulnerability exists in net/can/raw.c within the Linux kernel. The root cause is a race condition where raw_release() frees the per-CPU 'uniq' storage before deferred RCU callbacks (triggered by can_rx_unregister) have finished executing. This allows raw_rcv() to access the freed memory during an RCU read-side critical section. An attacker with local access can exploit this by opening and closing CAN raw sockets to trigger the race condition. The fix involves moving the memory deallocation to a socket destructor (sk_destruct), ensuring the memory is only freed after all references and RCU callbacks have cleared.
Affected products
- Linux Linux Kernel 4.1 to 6.6.136, 6.7 to 6.12.83, 6.18 to 6.18.24, 6.19 to 6.19.14, 7.0 to 7.0.1
Timeline
- 2026-04-08: other: Vulnerability fixed in upstream commits
- 2026-04-23: disclosed: Initial publication of CVE-2026-31532
- 2026-04-23: advisory
References
- https://git.kernel.org/stable/c/1a0f2de81f7fbdc538fc72d7d74609b79bc83cc0
- https://git.kernel.org/stable/c/1de30576a6dfeaaa27ef91fa272e6b9240b6fbd3
- https://git.kernel.org/stable/c/34c1741254ff972e8375faf176678a248826fe3a
- https://git.kernel.org/stable/c/3f43f12fde34737fba091b7e3ab391e14ddbb0be
- https://git.kernel.org/stable/c/572f0bf536ebc14f6e7da3d21a85cf076de8358e
- https://git.kernel.org/stable/c/5e9cfffad898bbeaafd0ea608a6d267362f050fc
- https://git.kernel.org/stable/c/64c8553decf5a5f2417bd54761ea0a832c56c4ca