In the Linux kernel, the following vulnerability has been resolved:
can: isotp: fix tx.buf use-after-free in isotp_sendmsg()
isotp_sendmsg() uses only cmpxchg() on so->tx.state to serialize access
to so->tx.buf. isotp_release() waits for ISOTP_IDLE via
wait_event_interruptible() and then calls kfree(so->tx.buf).
If a signal interrupts the wait_event_interruptible() inside close()
while tx.state is ISOTP_SENDING, the loop exits early and release
proceeds to force ISOTP_SHUTDOWN and continues to kfree(so->tx.buf)
while sendmsg may still be reading so->tx.buf for the final CAN frame
in isotp_fill_dataframe().
The so->tx.buf can be allocated once when the standard tx.buf length needs
to be extended. Move the kfree() of this potentially extended tx.buf to
sk_destruct time when either isotp_sendmsg() and isotp_release() are done.
References
Configurations
Configuration 1 (hide)
|
History
27 Apr 2026, 23:27
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://git.kernel.org/stable/c/2e62e7051eca75a7f2e3d52d62ec10d7d7aa358c - Patch | |
| References | () https://git.kernel.org/stable/c/424e95d62110cdbc8fd12b40918f37e408e35a92 - Patch | |
| References | () https://git.kernel.org/stable/c/9649d051e54413049c009638ec1dc23962c884a4 - Patch | |
| References | () https://git.kernel.org/stable/c/cb3d6efa78460e6d50bf68806d0db66265709f64 - Patch | |
| References | () https://git.kernel.org/stable/c/eec8a1b18a79600bd4419079dc0026c1db72a830 - Patch | |
| CWE | CWE-416 | |
| CPE | cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.4:-:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:* |
|
| First Time |
Linux
Linux linux Kernel |
27 Apr 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
22 Apr 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-22 14:16
Updated : 2026-04-27 23:27
NVD link : CVE-2026-31474
Mitre link : CVE-2026-31474
CVE.ORG link : CVE-2026-31474
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-416
Use After Free