CVE-2026-31474 Linux CVE debrief

Who should care

Linux kernel developers, administrators, and users who rely on the CAN isotp subsystem should be aware of this vulnerability. Affected Linux kernel versions include 6.4.1 to 6.6.131, 6.7 to 6.12.80, 6.13 to 6.18.21, 6.19 to 6.19.11, and 7.0 rc1 to rc7. Red Hat Enterprise Linux users should check for errata updates.

Technical summary

The CVE-2026-31474 vulnerability is a use-after-free condition in the Linux kernel's CAN isotp subsystem. The isotp_sendmsg() function uses cmpxchg() on so->tx.state to serialize access to so->tx.buf. However, if a signal interrupts the wait_event_interruptible() function inside close(), the kfree(so->tx.buf) is executed while sendmsg() may still be reading so->tx.buf. The fix moves kfree() to sk_destruct time. The vulnerability has a CVSS score of 7.8 and is classified as CWE-416 (Use After Free) and CWE-364 (Signal Handler Race Condition).

Defensive priority

High priority should be given to patching affected Linux kernel versions. Administrators should ensure that their Linux systems are updated with the latest kernel patches to prevent potential exploitation of this vulnerability.

Recommended defensive actions

• Apply kernel patches to update affected Linux kernel versions.
• Review and update Linux system configurations to ensure CAN isotp subsystem is properly secured.
• Monitor system logs for potential exploitation attempts.
• Consider implementing compensating controls, such as network segmentation or access controls, to limit the attack surface.
• Perform regular vulnerability assessments and penetration testing to identify potential vulnerabilities.

Evidence notes

The CVE-2026-31474 vulnerability was publicly disclosed on April 22, 2026, and has since been modified on June 30, 2026. The vulnerability affects multiple Linux kernel versions, including 6.4.1 to 6.6.131, 6.7 to 6.12.80, 6.13 to 6.18.21, 6.19 to 6.19.11, and 7.0 rc1 to rc7. Red Hat Enterprise Linux users should check for errata updates.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.