CVE-2026-31532: can: raw: fix ro->uniq use-after-free in raw_rcv()

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Linux). Independent of NVD's CPE analysis and usually ahead of it.

• Linux Linux

  • 4.1affected
  • 514ac99c64b22d83b52dfee3b8becaa69a92bc4a and later · before 1de30576a6dfeaaa27ef91fa272e6b9240b6fbd3affected · git
  • 514ac99c64b22d83b52dfee3b8becaa69a92bc4a and later · before 64c8553decf5a5f2417bd54761ea0a832c56c4caaffected · git
  • 514ac99c64b22d83b52dfee3b8becaa69a92bc4a and later · before 3f43f12fde34737fba091b7e3ab391e14ddbb0beaffected · git
  • 514ac99c64b22d83b52dfee3b8becaa69a92bc4a and later · before 5e9cfffad898bbeaafd0ea608a6d267362f050fcaffected · git
  • 514ac99c64b22d83b52dfee3b8becaa69a92bc4a and later · before 572f0bf536ebc14f6e7da3d21a85cf076de8358eaffected · git
  • 514ac99c64b22d83b52dfee3b8becaa69a92bc4a and later · before 1a0f2de81f7fbdc538fc72d7d74609b79bc83cc0affected · git
  • 514ac99c64b22d83b52dfee3b8becaa69a92bc4a and later · before 7201a531b9a5ed892bfda5ded9194ef622de8ffaaffected · git
  • 514ac99c64b22d83b52dfee3b8becaa69a92bc4a and later · before 34c1741254ff972e8375faf176678a248826fe3aaffected · git
  • 514ac99c64b22d83b52dfee3b8becaa69a92bc4a and later · before a535a9217ca3f2fccedaafb2fddb4c48f27d36dcaffected · git

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-31431crypto: algif_aead - Revert to operating out-of-placeKEV
  90Now
• CVE-2022-0847A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe…KEV
  89Now
• CVE-2021-22555Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACEKEV
  85Now

Published before and after this one in the same product

• ← EarlierCVE-2026-31530Apr 22, 2026 · cxl/port: Fix use after free of parent_port in cxl_detach_ep()
  31Monitor
• ← EarlierCVE-2026-31531Apr 23, 2026 · ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()
  22Monitor
• Later →CVE-2026-31533Apr 23, 2026 · net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption
  39Monitor

Root cause

After a memory region is freed, another reference pointing to it is still used. By then, the same region may have been allocated for different data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1free(dev->buf);2/* ... another thread is still running ... */3process(dev->buf);

1lock(&dev->lock);2free(dev->buf);3dev->buf = NULL;4unlock(&dev->lock);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.