Use-After-Free Vulnerability in Linux Kernel Affecting CAN Raw Socket

CVE-2026-31532

What is CVE-2026-31532?

A use-after-free vulnerability exists in the Linux kernel within the CAN raw socket implementation. When the raw_release() function unregisters raw CAN receive filters through can_rx_unregister(), a race condition is created due to deferred receiver deletion using call_rcu(). This design flaw can allow raw_rcv() to execute within an RCU read-side critical section even after raw_release() has freed the associated unique storage, resulting in unsafe access to freed memory. The proper fix involves relocating the freeing of per-cpu storage to a dedicated socket destructor, ensuring that the memory remains valid until all callbacks have completed.

References