CVE-2026-31474

Advisory lineage Upstream: 0 Downstream: 10
Analyzed
Published: 22 Apr 2026, 13:54
Last modified:15 Jul 2026, 01:09

Vulnerability Summary

Overall Risk (default)
medium
31/100
CVSS Score
7.8 HIGH
v3.1 (cve.org)
EPSS Score
0.1% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

22 Apr 2026, 13:54
Published
Vulnerability first disclosed
15 Jul 2026, 01:09
Last Modified
Vulnerability information updated

Description

In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() isotp_sendmsg() uses only cmpxchg() on so->tx.state to serialize access to so->tx.buf. isotp_release() waits for ISOTP_IDLE via wait_event_interruptible() and then calls kfree(so->tx.buf). If a signal interrupts the wait_event_interruptible() inside close() while tx.state is ISOTP_SENDING, the loop exits early and release proceeds to force ISOTP_SHUTDOWN and continues to kfree(so->tx.buf) while sendmsg may still be reading so->tx.buf for the final CAN frame in isotp_fill_dataframe(). The so->tx.buf can be allocated once when the standard tx.buf length needs to be extended. Move the kfree() of this potentially extended tx.buf to sk_destruct time when either isotp_sendmsg() and isotp_release() are done.

CVSS Metrics

  • v3.1•HIGH•Score: 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.10%• Percentile: 1%

Techniques & Countermeasures

  • CWE-416•Use After Free

    The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

  • CWE-364•Signal Handler Race Condition

    The product uses a signal handler that introduces a race condition.

Affected Systems

  • linux•linux

    ≥ 96d1c81e6a0478535342dff6c730adb076cd84e8, < cb3d6efa78460e6d50bf68806d0db66265709f64 | ≥ 96d1c81e6a0478535342dff6c730adb076cd84e8, < 9649d051e54413049c009638ec1dc23962c884a4 | ≥ 96d1c81e6a0478535342dff6c730adb076cd84e8, < eec8a1b18a79600bd4419079dc0026c1db72a830 | ≥ 96d1c81e6a0478535342dff6c730adb076cd84e8, < 2e62e7051eca75a7f2e3d52d62ec10d7d7aa358c | ≥ 96d1c81e6a0478535342dff6c730adb076cd84e8, < 424e95d62110cdbc8fd12b40918f37e408e35a92 | 6.4

  • linux•linux kernel

    ≥ 6.4.1, < 6.6.131 | ≥ 6.7, < 6.12.80 | ≥ 6.13, < 6.18.21 | ≥ 6.19, < 6.19.11 | 6.4 | 7.0:rc1 | 7.0:rc2 | 7.0:rc3 | 7.0:rc4 | 7.0:rc5 | 7.0:rc6 | 7.0:rc7

References (11)