CVE-2026-31474

A flaw was found in the Linux kernel's Controller Area Network (CAN) ISO-TP (isotp) module. This vulnerability, known as a use-after-free, occurs when the system attempts to free a memory region while it is still being used. A local attacker could trigger this condition by sending a signal that interrupts a specific waiting process during a close operation. This can lead to memory corruption, potentially causing the system to crash (denial of service) or behave unpredictably.

This is an Important use-after-free flaw in the Linux kernel's Controller Area Network (CAN) ISO-TP module. A local attacker can trigger this vulnerability by interrupting a specific waiting process, potentially leading to memory corruption and system instability or denial of service. The impact is significant due to the potential for system compromise from a local user.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Systems which do not require it can blocklist the can_isotp module to prevent it from being loaded. See https://access.redhat.com/solutions/41278 for more information.