Answer in brief
CVE-2026-31474 records a High severity (CVSS 7.8) vulnerability in can: isotp: fix tx.buf use-after-free in isotp_sendmsg(). The current sources do not mark it as known exploited. The current feed maps Red Hat/kernel-rt (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Red Hat/kernel-rt (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:6.4:-:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Red Hat/kernel-rtgeneric | * | Not reported |
| Linux/Linuxgeneric | >=96d1c81e6a0478535342dff6c730adb076cd84e8 <cb3d6efa78460e6d50bf68806d0db66265709f64 || >=96d1c81e6a0478535342dff6c730adb076cd84e8 <9649d051e54413049c009638ec1dc23962c884a4 || >=96d1c81e6a0478535342dff6c730adb076cd84e8 <eec8a1b18a79600bd4419079dc0026c1db72a830 || >=96d1c81e6a0478535342dff6c730adb076cd84e8 <2e62e7051eca75a7f2e3d52d62ec10d7d7aa358c || >=96d1c81e6a0478535342dff6c730adb076cd84e8 <424e95d62110cdbc8fd12b40918f37e408e35a92 | cb3d6efa78460e6d50bf68806d0db66265709f64, 9649d051e54413049c009638ec1dc23962c884a4, eec8a1b18a79600bd4419079dc0026c1db72a830, 2e62e7051eca75a7f2e3d52d62ec10d7d7aa358c, 424e95d62110cdbc8fd12b40918f37e408e35a92 |
| Linux/Linuxgeneric | 6.4 | Not reported |
Published upstream
Apr 22, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 15, 2026
In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() isotp_sendmsg() uses only cmpxchg() on so->tx.state to serialize access to so->tx.buf. isotp_release() waits for ISOTP_IDLE via wait_event_interruptible() and then calls kfree(so->tx.buf). If a signal interrupts the wait_event_interruptible() inside close() while tx.state is ISOTP_SENDING, the loop exits early and release proceeds to force ISOTP_SHUTDOWN and continues to kfree(so->tx.buf) while sendmsg may still be reading so->tx.buf for the final CAN frame in isotp_fill_dataframe(). The so->tx.buf can be allocated once when the standard tx.buf length needs to be extended. Move the kfree() of this potentially extended tx.buf to sk_destruct time when either isotp_sendmsg() and isotp_release() are done.
Quoted source text, attributed separately from HOL analysis.