CVE-2026-31532

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> can: raw: fix ro-&gt;uniq use-after-free in raw_rcv()<br /> <br /> raw_release() unregisters raw CAN receive filters via can_rx_unregister(),<br /> but receiver deletion is deferred with call_rcu(). This leaves a window<br /> where raw_rcv() may still be running in an RCU read-side critical section<br /> after raw_release() frees ro-&gt;uniq, leading to a use-after-free of the<br /> percpu uniq storage.<br /> <br /> Move free_percpu(ro-&gt;uniq) out of raw_release() and into a raw-specific<br /> socket destructor. can_rx_unregister() takes an extra reference to the<br /> socket and only drops it from the RCU callback, so freeing uniq from<br /> sk_destruct ensures the percpu area is not released until the relevant<br /> callbacks have drained.<br /> <br /> [mkl: applied manually]