LiveActive security incident?Get immediate response
CVE Record

CVE-2026-31474: can: isotp: fix tx.buf use-after-free in isotp_sendmsg()

In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() isotp_sendmsg() uses only cmpxchg() on so->tx.state to serialize access to so->tx.buf. isotp_release() waits for ISOTP_IDLE via wait_event_interruptible() and then calls kfree(so->tx.buf). If a signal interrupts the wait_event_interruptible() inside close() while tx.state is ISOTP_SENDING, the loop exits early and release proceeds to force ISOTP_SHUTDOWN and continues to kfree(so->tx.buf) while sendmsg may still be reading so->tx.buf for the final CAN frame in isotp_fill_dataframe(). The so->tx.buf can be allocated once when the standard tx.buf length needs to be extended. Move the kfree() of this potentially extended tx.buf to sk_destruct time when either isotp_sendmsg() and isotp_release() are done.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A race during concurrent CAN ISO-TP message sending and socket closure can leave the Linux kernel reading freed memory. A local, low-privileged user may potentially crash the system or compromise confidentiality and integrity. Systems using CAN ISO-TP, including some automotive or industrial environments, warrant prompt review.

Executive priority

Prioritize affected multi-user, automotive, industrial, laboratory, and embedded Linux systems where untrusted local users can access CAN ISO-TP functionality. Schedule prompt kernel remediation, but do not treat this as an internet-wide emergency because the documented attack vector is local and active exploitation is not evidenced.

Technical view

CVE-2026-31474 is a use-after-free in isotp_sendmsg(). A signal can interrupt isotp_release() while transmission remains active, causing tx.buf to be freed before the final CAN frame finishes reading it. The fix defers freeing a potentially extended buffer until socket destruction, after send and release operations complete.

Likely exposure

Exposure requires local, low-privileged access and a Linux environment where CAN ISO-TP is available or used. It is not described as remotely exploitable. The supplied version data is ambiguous, so vulnerability managers should determine exposure using distributor advisories and whether their running kernel contains the applicable stable fix.

Exploitation context

The CVSS 3.1 score is 7.8, with local access, low complexity, low privileges, no user interaction, and potentially high confidentiality, integrity, and availability impact. The bundle marks KEV false and provides no evidence of active exploitation or a public exploit. Practical exploitability is not established here.

Researcher notes

The vulnerable lifetime transition involves tx.state serialization, signal-interrupted waiting in isotp_release(), and premature freeing of an extended tx.buf while isotp_fill_dataframe() may still read it. The upstream correction moves freeing to sk_destruct. The bundle does not establish exploit reliability, observed attacks, or an authoritative single affected-version range.

Mitigation direction

  • Install the applicable vendor kernel update containing the referenced stable fix.
  • For Red Hat systems, identify and apply the relevant listed RHSA advisory.
  • Reboot into the updated kernel when required by the distributor.
  • Restrict unnecessary local access while affected systems await maintenance.
  • Consult the Linux distributor if branch-specific fixed-version status remains unclear.

Validation and detection

  • Inventory running kernel versions and Linux distribution packages.
  • Identify systems where CAN ISO-TP is enabled or operationally used.
  • Confirm the installed kernel contains the applicable stable fix or vendor erratum.
  • After updating and rebooting, verify the corrected kernel is running.
  • Run normal CAN ISO-TP regression testing without attempting exploitation.
Prepared
Confidence
medium
Sources
11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-364: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-31474 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
5Timeline events
1ADP providers
12Source links

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9redhat-SADP

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2026-31474Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. ADP timelineredhat-SADP

    Reported to Red Hat.

  3. ADP timelineredhat-SADP

    Made public.

  4. CVE publishedCVE Program

    The CVE record was published.

  5. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

redhat-SADPkernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg()
other:Red Hat severity ratingcvssV3_1
  • 2026-04-22T00:00:00.000Z: Reported to Red Hat.
  • 2026-04-22T00:00:00.000Z: Made public.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux96d1c81e6a0478535342dff6c730adb076cd84e8, 96d1c81e6a0478535342dff6c730adb076cd84e8, 96d1c81e6a0478535342dff6c730adb076cd84e8, 96d1c81e6a0478535342dff6c730adb076cd84e8, 96d1c81e6a0478535342dff6c730adb076cd84e8unaffected
LinuxLinux6.4, 0, 6.6.131, 6.12.80, 6.18.21, 6.19.11, 7.0affected
Weakness

CWE details

CWE-364

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-364 · source CWE mapping

Signal Handler Race Condition

Signal Handler Race Condition represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs