CVE-2026-31474
can: isotp: fix tx.buf use-after-free in isotp_sendmsg()
Reported by linux · Published April 22, 2026
In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() isotp_sendmsg() uses only cmpxchg() on so->tx.state to serialize access to so->tx.buf. isotp_release() waits for ISOTP_IDLE via wait_event_interruptible() and then calls kfree(so->tx.buf). If a signal interrupts the wait_event_interruptible() inside close() while tx.state is ISOTP_SENDING, the loop exits early and release proceeds to force ISOTP_SHUTDOWN and continues to kfree(so->tx.buf) while sendmsg may still be reading so->tx.buf for the final CAN frame in isotp_fill_dataframe(). The so->tx.buf can be allocated once when the standard tx.buf length needs to be extended. Move the kfree() of this potentially extended tx.buf to sk_destruct time when either isotp_sendmsg() and isotp_release() are done.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| libperf-debuginfo | errata.rockylinux.org | 6.12.0-211.26.1.el10 |
| kernel-debug-modules-extra | errata.rockylinux.org | 6.12.0-211.26.1.el10, 5.14.0-687.17.1.el9 |
| kernel-devel | errata.rockylinux.org | 6.12.0-211.26.1.el10 |
| Linux | Linux | 6.4, 424e95d62110cdbc8fd12b40918f37e408e35a92 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | 96d1c81e6a0478535342dff6c730adb076cd84e8, 96d1c81e6a0478535342dff6c730adb076cd84e8, 96d1c81e6a0478535342dff6c730adb076cd84e8 |
| Linux | Linux | 6.4, 0, 6.6.131 |
| Linux | Linux | 96d1c81e6a0478535342dff6c730adb076cd84e8, 6.19.11, 6.18.21 |
| Red Hat | Red Hat Enterprise Linux BaseOS EUS (v. 10.0) | |
| Red Hat | Red Hat Enterprise Linux 9 | |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | 0:6.12.0-55.82.1.el10_0 |
| Red Hat | Red Hat Enterprise Linux 6 | |
| Red Hat | Red Hat Enterprise Linux 8 | |
| Red Hat | Red Hat Enterprise Linux 10 | 0:6.12.0-211.26.1.el10_2 |
| Red Hat | Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0) | |
| Red Hat | Red Hat Enterprise Linux Real Time for NFV (v. 10) | |
| Red Hat | Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) | |
| Red Hat | Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) | |
| Red Hat | Red Hat Enterprise Linux 7 | |
| Red Hat | Red Hat Enterprise Linux 9 | |
| Red Hat | Red Hat Enterprise Linux AppStream (v. 9) | |
| Red Hat | Red Hat Enterprise Linux Real Time for NFV (v. 9) | |
| linux | linux_kernel | 6.4, 6.4, 6.4 |
| Red Hat | Red Hat Enterprise Linux Real Time EUS (v. 10.0) | |
| Red Hat | Red Hat Enterprise Linux BaseOS (v. 10) |
…and 12 more
Timeline
- Apr 22, 2026 CVE Published
- Apr 23, 2026 Security Advisory (98 in total, the first dated here)
- May 18, 2026 EPSS Score (22 in total, the first dated here)
- Jun 20, 2026 Distribution Patch (95 in total, the first dated here)
- Jul 16, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-31474
vulnetix vdb fixes CVE-2026-31474Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-31474/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://access.redhat.com/security/cve/CVE-2026-31474 vdb
- RHBZ#2460646 issue
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31474.json url
- https://access.redhat.com/errata/RHSA-2026:27731 vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:27288 vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:27789 vendor-advisory