CVE-2026-31532
published 2026-04-23CVE-2026-31532: In the Linux kernel, the following vulnerability has been resolved: can: raw: fix ro->uniq use-after-free in raw_rcv() raw_release() unregisters raw CAN…
PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.12%
2.5th percentile
In the Linux kernel, the following vulnerability has been resolved:
can: raw: fix ro->uniq use-after-free in raw_rcv()
raw_release() unregisters raw CAN receive filters via can_rx_unregister(),
but receiver deletion is deferred with call_rcu(). This leaves a window
where raw_rcv() may still be running in an RCU read-side critical section
after raw_release() frees ro->uniq, leading to a use-after-free of the
percpu uniq storage.
Move free_percpu(ro->uniq) out of raw_release() and into a raw-specific
socket destructor. can_rx_unregister() takes an extra reference to the
socket and only drops it from the RCU callback, so freeing uniq from
sk_destruct ensures the percpu area is not released until the relevant
callbacks have drained.
[mkl: applied manually]
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 514ac99c64b22d83b52dfee3b8becaa69a92bc4a < 1de30576a6dfeaaa27ef91fa272e6b9240b6fbd3 | 1de30576a6dfeaaa27ef91fa272e6b9240b6fbd3 |
| linux | linux | >= 514ac99c64b22d83b52dfee3b8becaa69a92bc4a < 64c8553decf5a5f2417bd54761ea0a832c56c4ca | 64c8553decf5a5f2417bd54761ea0a832c56c4ca |
| linux | linux | >= 514ac99c64b22d83b52dfee3b8becaa69a92bc4a < 3f43f12fde34737fba091b7e3ab391e14ddbb0be | 3f43f12fde34737fba091b7e3ab391e14ddbb0be |
| linux | linux | >= 514ac99c64b22d83b52dfee3b8becaa69a92bc4a < 5e9cfffad898bbeaafd0ea608a6d267362f050fc | 5e9cfffad898bbeaafd0ea608a6d267362f050fc |
| linux | linux | >= 514ac99c64b22d83b52dfee3b8becaa69a92bc4a < 572f0bf536ebc14f6e7da3d21a85cf076de8358e | 572f0bf536ebc14f6e7da3d21a85cf076de8358e |
| linux | linux | >= 514ac99c64b22d83b52dfee3b8becaa69a92bc4a < 1a0f2de81f7fbdc538fc72d7d74609b79bc83cc0 | 1a0f2de81f7fbdc538fc72d7d74609b79bc83cc0 |
| linux | linux | >= 514ac99c64b22d83b52dfee3b8becaa69a92bc4a < 7201a531b9a5ed892bfda5ded9194ef622de8ffa | 7201a531b9a5ed892bfda5ded9194ef622de8ffa |
| linux | linux | >= 514ac99c64b22d83b52dfee3b8becaa69a92bc4a < 34c1741254ff972e8375faf176678a248826fe3a | 34c1741254ff972e8375faf176678a248826fe3a |
| linux | linux | >= 514ac99c64b22d83b52dfee3b8becaa69a92bc4a < a535a9217ca3f2fccedaafb2fddb4c48f27d36dc | a535a9217ca3f2fccedaafb2fddb4c48f27d36dc |
| linux | linux_kernel | — | — |
| linux | linux_kernel | 4.1 – 6.6.136 | — |
| linux | linux_kernel | >= 6.18 < 6.18.24 | 6.18.24 |
| linux | linux_kernel | >= 6.19 < 6.19.14 | 6.19.14 |
| linux | linux_kernel | >= 6.7 < 6.12.83 | 6.12.83 |
| linux | linux_kernel | >= 7.0 < 7.0.1 | 7.0.1 |
| ubuntu | linux | — | — |
| ubuntu | linux-aws | — | — |
| ubuntu | linux-gcp | — | — |
| ubuntu | linux-ibm | — | — |
| ubuntu | linux-nvidia | — | — |
| ubuntu | linux-oracle | — | — |
| ubuntu | linux-raspi | — | — |
| ubuntu | linux-realtime | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.0HIGH
vendor_ubuntu2.0LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (NVIDIA) vulnerabilities
vendor_ubuntu·2026-07-06·CVSS 2.0
CVE-2026-46009 [LOW] Linux kernel (NVIDIA) vulnerabilities
Title: Linux kernel (NVIDIA) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Rados block device (RBD) driver;
- Compressed RAM block device driver;
- Character device driver;
- TPM device driver;
- Hardware crypto device drivers;
- EDAC drivers;
- GPU drivers;
- Greybus drive
Ubuntu
Linux kernel (Raspberry Pi) vulnerabilities
vendor_ubuntu·2026-07-02·CVSS 2.0
CVE-2026-46316 [LOW] Linux kernel (Raspberry Pi) vulnerabilities
Title: Linux kernel (Raspberry Pi) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Rados block device (RBD) driver;
- Compressed RAM block device driver;
- Character device driver;
- TPM device driver;
- Hardware crypto device drivers;
- EDAC drivers;
- GPU drivers;
- Greybus
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-01·CVSS 2.0
CVE-2026-46042 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Rados block device (RBD) driver;
- Compressed RAM block device driver;
- Character device driver;
- TPM device driver;
- Hardware crypto device drivers;
- EDAC drivers;
- GPU drivers;
- Greybus drivers;
- HID
Red Hat
kernel: can: raw: fix ro->uniq use-after-free in raw_rcv()
vendor_redhat·2026-04-23·CVSS 7.0
CVE-2026-31532 [HIGH] CWE-366 kernel: can: raw: fix ro->uniq use-after-free in raw_rcv()
kernel: can: raw: fix ro->uniq use-after-free in raw_rcv()
A flaw was found in the Linux kernel's Controller Area Network (CAN) raw socket implementation. A use-after-free vulnerability can occur due to a timing window during the unregistration of CAN receive filters, allowing a freed memory region to be accessed. This could lead to system instability or a denial of service (DoS).
Package: kernel (Red Hat Enterprise Linux 10) - Affected
Package: kernel (Red Hat Enterprise Linux 6) - Under investigation
Package: kernel (Red Hat Enterprise Linux 7) - Affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Affected
Package: kernel (Red Hat Enterprise Linux 8) - Affected
Package: kernel-rt (Red Hat Enterprise Linux 8) - Affected
Package: kernel (Red Hat Enterprise Linux 9) - Affecte
GHSA
GHSA-7w6x-pfmg-76xx: In the Linux kernel, the following vulnerability has been resolved:
can: raw: fix ro->uniq use-after-free in raw_rcv()
raw_release() unregisters raw
ghsa_unreviewed·2026-04-23
CVE-2026-31532 GHSA-7w6x-pfmg-76xx: In the Linux kernel, the following vulnerability has been resolved:
can: raw: fix ro->uniq use-after-free in raw_rcv()
raw_release() unregisters raw
In the Linux kernel, the following vulnerability has been resolved:
can: raw: fix ro->uniq use-after-free in raw_rcv()
raw_release() unregisters raw CAN receive filters via can_rx_unregister(),
but receiver deletion is deferred with call_rcu(). This leaves a window
where raw_rcv() may still be running in an RCU read-side critical section
after raw_release() frees ro->uniq, leading to a use-after-free of the
percpu uniq storage.
Move free_percpu(ro->uniq) out of raw_release() and into a raw-specific
socket destructor. can_rx_unregister() takes an extra reference to the
socket and only drops it from the RCU callback, so freeing uniq from
sk_destruct ensures the percpu area is not released until the relevant
callbacks have drained.
[mkl: applied manually]
VulDB
Linux Kernel up to 6.12.82/6.18.23/6.19.13/7.0.0 raw_rcv use after free (EUVD-2026-25219)
vuldb·2026-04-23
CVE-2026-31532 [CRITICAL] Linux Kernel up to 6.12.82/6.18.23/6.19.13/7.0.0 raw_rcv use after free (EUVD-2026-25219)
A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.12.82/6.18.23/6.19.13/7.0.0. This affects the function raw_rcv. The manipulation results in use after free.
This vulnerability is known as CVE-2026-31532. Access to the local network is required for this attack. No exploit is available.
You should upgrade the affected component.
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/1a0f2de81f7fbdc538fc72d7d74609b79bc83cc0https://git.kernel.org/stable/c/1de30576a6dfeaaa27ef91fa272e6b9240b6fbd3https://git.kernel.org/stable/c/34c1741254ff972e8375faf176678a248826fe3ahttps://git.kernel.org/stable/c/3f43f12fde34737fba091b7e3ab391e14ddbb0behttps://git.kernel.org/stable/c/572f0bf536ebc14f6e7da3d21a85cf076de8358ehttps://git.kernel.org/stable/c/5e9cfffad898bbeaafd0ea608a6d267362f050fchttps://git.kernel.org/stable/c/64c8553decf5a5f2417bd54761ea0a832c56c4cahttps://git.kernel.org/stable/c/7201a531b9a5ed892bfda5ded9194ef622de8ffahttps://git.kernel.org/stable/c/a535a9217ca3f2fccedaafb2fddb4c48f27d36dc
2026-04-23
Published