CVE-2026-68387

A flaw was found in the Linux kernel's Controller Area Network (CAN) raw socket implementation. A local attacker could exploit a race condition in the raw_setsockopt() function. This occurs due to insufficient locking during read-modify-write operations on a shared bitfield when modifying socket flags. Successful exploitation could lead to data corruption or system instability, potentially resulting in a denial of service.

This issue affects CAN raw sockets. Converting CAN_RAW flags to a bitfield introduced unsynchronized read-modify-write races when multiple threads set socket options concurrently. Systems not using CAN raw sockets are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.