Status: UPDATED | Advisory ID: CVE-2026-31532
| CVE | CVE-2026-31532 |
| CVSS Score / Version | |
| Updated | 2026-10-15 |
| CVSS Vector | |
| CVSS Prose | |
| Affected products | |
| Classified as | |
| Exploitation prediction (EPSS) |
| Vendor | Product | Affected Versions | Patch Status |
|---|---|---|---|
| Linux | Linux Kernel | ||
| Siemens | SIMATIC S7-1500 TM MFP - GNU/Linux subsystem |
| Subsystems | Controllers & Field I/O, OT Supporting Infrastructure |
| Sectors | All Sectors |
In the Linux kernel, the following vulnerability has been resolved:
can: raw: fix ro->uniq use-after-free in raw_rcv()
raw_release() unregisters raw CAN receive filters via can_rx_unregister(),
but receiver deletion is deferred with call_rcu(). This leaves a window
where raw_rcv() may still be running in an RCU read-side critical section
after raw_release() frees ro->uniq, leading to a use-after-free of the
percpu uniq storage.
Move free_percpu(ro->uniq) out of raw_release() and into a raw-specific
socket destructor. can_rx_unregister() takes an extra reference to the
socket and only drops it from the RCU callback, so freeing uniq from
sk_destruct ensures the percpu area is not released until the relevant
callbacks have drained.
[mkl: applied manually] (NVD)
Monitor Linux's and Siemens's web pages for any future patch releases.
| Source | Reference |
|---|---|
| NVD | https://nvd.nist.gov/vuln/detail/CVE-2026-31532 |
| CVE | https://www.cve.org/CVERecord?id=CVE-2026-31532 |