In the Linux kernel, the following vulnerability has been resolved: can: raw: fix ro->uniq use-after-free in raw_rcv() raw_release() unregisters raw CAN receive filters via can_rx_unregister(), but receiver deletion is deferred with call_rcu(). This leaves a window where raw_rcv() may still be running in an RCU read-side critical section after raw_release() frees ro->uniq, leading to a use-after-free of the percpu uniq storage. Move free_percpu(ro->uniq) out of raw_release() and into a raw-specific socket destructor. can_rx_unregister() takes an extra reference to the socket and only drops it from the RCU callback, so freeing uniq from sk_destruct ensures the percpu area is not released until the relevant callbacks have drained. [mkl: applied manually]
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2026042349-CVE-2026-31532-a820@gregkh/T
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Extended Update Support Via RHSA-2026:13932 https://access.redhat.com/errata/RHSA-2026:13932
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:14339 https://access.redhat.com/errata/RHSA-2026:14339
This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:15883 https://access.redhat.com/errata/RHSA-2026:15883
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:19521 https://access.redhat.com/errata/RHSA-2026:19521
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:19568 https://access.redhat.com/errata/RHSA-2026:19568
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Via RHSA-2026:19705 https://access.redhat.com/errata/RHSA-2026:19705
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Via RHSA-2026:19711 https://access.redhat.com/errata/RHSA-2026:19711
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:19875 https://access.redhat.com/errata/RHSA-2026:19875
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2026:20130 https://access.redhat.com/errata/RHSA-2026:20130
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:20593 https://access.redhat.com/errata/RHSA-2026:20593
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:21706 https://access.redhat.com/errata/RHSA-2026:21706
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:21745 https://access.redhat.com/errata/RHSA-2026:21745
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2026:25095 https://access.redhat.com/errata/RHSA-2026:25095