High 7.8Published Apr 22, 2026

CVE-2026-31474can: isotp: fix tx.buf use-after-free in isotp_sendmsg()

Updated under an hour ago (Oct 26, 2026, 8:40 PM ET)

Does this affect you?

It affects Linux and 3 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() isotp_sendmsg() uses only cmpxchg() on so->tx.state to serialize access to so->tx.buf. isotp_release() waits for ISOTP_IDLE via wait_event_interruptible() and then calls kfree(so->tx.buf). If a signal interrupts the wait_event_interruptible() inside close() while tx.state is ISOTP_SENDING, the loop exits early and release proceeds to force ISOTP_SHUTDOWN and continues to kfree(so->tx.buf) while sendmsg may still be reading so->tx.buf for the final CAN frame in isotp_fill_dataframe(). The so->tx.buf can be allocated once when the standard tx.buf length needs to be extended. Move the kfree() of this potentially extended tx.buf to sk_destruct time when either isotp_sendmsg() and isotp_release() are done.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-364, CWE-416
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 96d1c81e6a0478535342dff6c730adb076cd84e8 before cb3d6efa78460e6d50bf68806d0db66265709f64; from 96d1c81e6a0478535342dff6c730adb076cd84e8 before 9649d051e54413049c009638ec1dc23962c884a4; from 96d1c81e6a0478535342dff6c730adb076cd84e8 before eec8a1b18a79600bd4419079dc0026c1db72a830; 96d1c81e6a0478535342dff6c730adb076cd84e8 builds before 2e62e7051eca75a7f2e3d52d62ec10d7d7aa358c; from 96d1c81e6a0478535342dff6c730adb076cd84e8 before 424e95d62110cdbc8fd12b40918f37e408e35a92	CNA record
Red Hat Red Hat Enterprise Linux 10 redhat:enterprise_linux	from 0:6.12.0-211.26.1.el10_2 not affected	CISA ADP
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support redhat:enterprise_linux_eus	from 0:6.12.0-55.82.1.el10_0 not affected	CISA ADP
linux linux_kernel linux:linux_kernel	from 6.4.1 before 6.6.131; from 6.7 before 6.12.80; from 6.13 before 6.18.21; from 6.19 before 6.19.11; 6.4; 7.0; 7.0; 7.0; and 4 more ranges	NVD

References

References

https://git.kernel.org/stable/c/cb3d6efa78460e6d50bf68806d0db66265709f64	patch
https://git.kernel.org/stable/c/9649d051e54413049c009638ec1dc23962c884a4	patch
https://git.kernel.org/stable/c/eec8a1b18a79600bd4419079dc0026c1db72a830	patch
https://git.kernel.org/stable/c/2e62e7051eca75a7f2e3d52d62ec10d7d7aa358c	patch
https://git.kernel.org/stable/c/424e95d62110cdbc8fd12b40918f37e408e35a92	patch
https://access.redhat.com/errata/RHSA-2026:27288
https://access.redhat.com/errata/RHSA-2026:27731
https://access.redhat.com/errata/RHSA-2026:27789
https://access.redhat.com/security/cve/CVE-2026-31474
https://bugzilla.redhat.com/show_bug.cgi?id=2460646
1–10 of 11

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.