SECUFOCUSNOW
Home›CVE index›CVE-2026-31474
Review reviewHigh

CVE-2026-31474

Linux Linux, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support

In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() isotp_sendmsg() uses only cmpxchg() on so->tx.state to serialize access to so->tx.buf. isotp_release() waits for ISOTP_IDLE via wait_event_interruptible() and then calls kfree(so->tx.buf). If a signal interrupts the wait_event_interruptible() inside close() while tx.state is ISOTP_SENDING, the loop exits early and release proceeds to force ISOTP_SHUTDOWN and continues to kfree(so->tx.buf) while sendmsg may still be reading so->tx.buf for the final CAN frame in isotp_f...

CVSS
7.8
EPSS
0.10%
1.19% percentile
CISA KEV
Not listed
Published
2026.04.22
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.10%
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() isotp_sendmsg() uses only cmpxchg() on so->tx.state to serialize access to so->tx.buf. isotp_release() waits for ISOTP_IDLE via wait_event_interruptible() and then calls kfree(so->tx.buf). If a signal interrupts the wait_event_interruptible() inside close() while tx.state is ISOTP_SENDING, the loop exits early and release proceeds to force ISOTP_SHUTDOWN and continues to kfree(so->tx.buf) while sendmsg may still be reading so->tx.buf for the final CAN frame in isotp_f...

Affected product and versions

Product
Linux Linux, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support
Affected versions
>= 96d1c81e6a0478535342dff6c730adb076cd84e8 < cb3d6efa78460e6d50bf68806d0db66265709f64, >= 96d1c81e6a0478535342dff6c730adb076cd84e8 < 9649d051e54413049c009638ec1dc23962c884a4, >= 96d1c81e6a0478535342dff6c730adb076cd84e8 < eec8a1b18a79600bd4419079dc0026c1db72a830, >= 96d1c81e6a0478535342dff6c730adb076cd84e8 < 2e62e7051eca75a7f2e3d52d62ec10d7d7aa358c, >= 96d1c81e6a0478535342dff6c730adb076cd84e8 < 424e95d62110cdbc8fd12b40918f37e408e35a92, >= 6.4, >= 6.4.1 < 6.6.131, >= 6.7 < 6.12.80, >= 6.13 < 6.18.21, >= 6.19 < 6.19.11, 6.4, 7.0
Fixed versions
6.6.131, 6.12.80, 6.18.21, 6.19.11

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-364, CWE-416