Linux SocketCAN Race Condition Causes Kernel Use-After-Free

Bynario disclosed CVE-2026-31532, a Linux kernel use-after-free flaw in net/can/ affecting SocketCAN CAN_RAW sockets since v4.1. The bug stems from a race between raw_release() and raw_rcv(): the kernel frees the per-CPU ro->uniq structure before RCU-deferred receiver callbacks have fully drained, allowing concurrent CAN frame reception to access freed memory. The issue can cause kernel memory corruption and may enable local privilege escalation where CAN support is reachable, including through virtual CAN interfaces commonly used for testing and development.

The vendor said its pipeline both discovered and validated the flaw, and a proof of concept reliably triggered the race through concurrent sender activity and socket teardown. An upstream fix was accepted that moves free_percpu(ro->uniq) out of raw_release() and into a socket destructor so memory is released only after the relevant RCU-protected callbacks complete. In a related evaluation of AI-assisted kernel research, Bynario reported that frontier models consistently found and validated this bug more effectively than small local models, although orchestrated local models improved substantially in discovery performance.