CVE-2026-31474
Use-After-Free in Linux Kernel CAN ISOTP Transmit Buffer
Publication date: 2026-04-22
Last updated on: 2026-04-27
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.4 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 6.13 (inc) to 6.18.21 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 6.19.11 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.80 (exc) |
| linux | linux_kernel | From 6.4.1 (inc) to 6.6.131 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-416 | The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's CAN protocol implementation, specifically in the isotp_sendmsg() function. The issue is a use-after-free bug involving the tx.buf buffer. When a signal interrupts a wait inside the close() function while a transmission is still in progress, the release function prematurely frees the tx.buf memory. However, the sendmsg function may still be accessing this buffer to send the final CAN frame, leading to a use-after-free condition.
The fix involves deferring the freeing of the tx.buf buffer until the socket destruction phase (sk_destruct time), ensuring that both sending and releasing operations are fully completed before the memory is freed.
How can this vulnerability impact me? :
This use-after-free vulnerability can lead to undefined behavior such as memory corruption, crashes, or potential execution of arbitrary code within the kernel. Such impacts can compromise system stability and security, potentially allowing attackers to cause denial of service or escalate privileges.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed by modifying the Linux kernel's isotp_sendmsg() and isotp_release() functions to properly manage the lifecycle of the tx.buf buffer, moving its deallocation to sk_destruct time. To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this fix.