Loading story…
Bynario disclosed CVE-2026-31532, a Linux kernel use-after-free flaw in net/can/ affecting SocketCAN CAN_RAW sockets since v4.1. The bug stems from a race between raw_release() and raw_rcv(): the kernel frees the per-CPU ro->uniq structure before RCU-deferred receiver callbacks have fully drained, allowing concurrent CAN frame reception to access freed memory. The issue can cause kernel memory corruption and may enable local privilege escalation where CAN support is reachable, including through virtual CAN interfaces commonly used for testing and development.
The vendor said its pipeline both discovered and validated the flaw, and a proof of concept reliably triggered the race through concurrent sender activity and socket teardown. An upstream fix was accepted that moves free_percpu(ro->uniq) out of raw_release() and into a socket destructor so memory is released only after the relevant RCU-protected callbacks complete. In a related evaluation of AI-assisted kernel research, Bynario reported that frontier models consistently found and validated this bug more effectively than small local models, although orchestrated local models improved substantially in discovery performance.
Get the actors, campaigns, and ATT&CK mapping behind it.
6 events from the most recent confirmed update back to the earliest known activity.
The Linux kernel CAN raw socket use-after-free later assigned CVE-2026-31532 was introduced by commit 514ac99c64b2, titled "can: fix multiple delivery of a single CAN frame for overlapping CAN filters." The write-up states affected versions begin with Linux v4.1.
When Bynario applied an orchestration framework covering threat modeling, discovery, review, and validation, local-model discovery improved substantially. The Qwen 3.6 models reached 80-100% discovery rates, though validation remained difficult and only one Qwen 3.6 27B run successfully triggered a vulnerability.
A Bynario case study evaluated local open-weight models against Opus 4.6 on discovering and validating CVE-2026-31532 in net/can/ and CVE-2026-31694 in fs/fuse/. In baseline testing, none of the local models found either bug across five runs per vulnerability, while Opus 4.6 found both in every run.
An upstream patch for CVE-2026-31532 was accepted, changing SocketCAN teardown so the per-CPU ro->uniq allocation is freed only after relevant RCU-protected callbacks complete. The patch was acknowledged by Oliver Hartkopp and signed off by Marc Kleine-Budde.
Samuel Page proposed an upstream fix for CVE-2026-31532 that moves free_percpu(ro->uniq) out of raw_release() into a raw-specific socket destructor. The accepted patch also sets sk->sk_destruct = raw_sock_destruct in raw_init().
While analyzing Linux kernel 7.0, Bynario's pipeline discovered and validated CVE-2026-31532, a race-condition use-after-free in SocketCAN CAN_RAW sockets between raw_release() and raw_rcv(). The validation used custom instrumentation and a proof-of-concept that triggered the race on a vcan0 interface.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
bynar.io
Open sourcebynar.io
Open sourcedocs.kernel.org
Open sourceoracle.github.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat disclosed and patched **CVE-2023-52922**, an Important use-after-free flaw in the Linux kernel's CAN Broadcast Manager (**CAN BCM**) subsystem that could let local, unprivileged users disclose kernel memory on **RHEL 9**. The bug stemmed from `bcm_release()` freeing `bcm_op` objects before removing their procfs entries, allowing `bcm_proc_show()` to read freed memory concurrently through `/proc/net/can-bcm`. Red Hat rated the issue **CVSS 7.8** and warned it could lead to information disclosure, denial of service, memory corruption, and potentially code execution; fixes were shipped in March 2025 through RHEL 9 kernel advisories including **RHSA-2025:2627** and kernel version `5.14.0-503.31.1.el9_5`. Research published by Allele Security showed the flaw could be exploited in environments where unprivileged user and network namespaces are enabled and a CAN interface can be created, such as with **VXCAN**, to leak encoded **SLUB** freelist pointers and slab addresses useful for bypassing kernel mitigations. The upstream Linux fix, commit `55c3b96`, reordered CAN BCM cleanup so the procfs entry is removed earlier, and the researchers later released proof-of-concept code and noted the subsystem contained additional procfs-related memory-safety issues, including **CVE-2025-38003** and **CVE-2025-38004**; a later upstream patch, commit `dac5e62`, added missing **RCU** read protection for CAN BCM procfs handling.
Aug 26, 2026
A flaw in the Linux kernel CAN networking receive path, tracked as **CVE-2023-2166**, can allow a local low-privileged user to crash an affected system. The defect occurs when `can_rcv_filter` handles received CAN frames and dereferences the CAN-specific `ml_priv` pointer without confirming it was initialized, resulting in a NULL-pointer dereference and denial of service. The condition can arise because bonding or TUN network devices may report the CAN hardware type (`ARPHRD_CAN`) without initializing `ml_priv`; the issue was reported by syzbot and Wei Chen and fixed upstream by adding the required initialization check. Red Hat rates the issue **CVSS 5.5 (Moderate)**, with availability impact only, and released corrected kernel packages for affected Red Hat Enterprise Linux 8 and 9 systems in errata including **RHSA-2024:0461**, **RHSA-2024:0881**, and **RHSA-2024:0897**.
Aug 26, 2026
Researchers disclosed **CVE-2024-36904**, a seven-year-old race condition in the Linux kernel TCP subsystem that can lead to a real use-after-free involving `TIME-WAIT` sockets. The flaw was introduced by commit `ec94c2696f0b`, which changed `inet_twsk_hashdance()` so a socket could be inserted into the established hash table before its reference counter was initialized, allowing concurrent code in paths such as `tcp_twsk_unique()` and `__inet_check_established()` to observe a zero refcount and corrupt socket lifetime handling. The issue was first encountered while investigating a syzkaller report that appeared tied to KCM, but researchers determined it was unrelated and reproducible even with `CONFIG_AF_KCM` disabled. Allele Security reproduced the bug on a RHEL-derived `5.14.0-362.24.2.el9_3.x86_64` kernel and on Fedora 39 `6.8.6-200.fc39.x86_64`, where it initially manifested as refcount warnings. The researchers said Linux refcount protections usually degrade such races into leaks, but in this case a later `refcount_set()` could overwrite the saturated value and create an unbalanced reference count, enabling premature free; with a modified KASAN-enabled research kernel, they obtained an actual use-after-free report in `inet_twsk_put()`. Upstream addressed the flaw in commit `f2db7230f73a` by changing `tcp_twsk_unique()` to use `refcount_inc_not_zero()` before taking a reference to the `TIME-WAIT` socket.
Aug 20, 2026