CVE-2026-68387

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The race is driven entirely through local syscalls on an AF_CAN/CAN_RAW socket — one thread calling bind() while another calls setsockopt(SOL_CAN_RAW, CAN_RAW_LOOPBACK). No network packet is needed to trigger the corruption, so the attack vector is local.

AC:LAttack complexity, low

The attacker controls both sides of the race, holding the same fd and issuing concurrent bind()/setsockopt() from two threads it pins itself, and can loop the attempt indefinitely until the unlocked read-modify-write on the shared bitfield word loses the update to ro->bound. No condition lies outside attacker control.

PR:LPrivileges required, low

can_create() and raw_proto impose no capability check, so any unprivileged local user can open a CAN_RAW socket; a user namespace (unshare -Urn) additionally lets an unprivileged attacker create a vcan device to bind to, so only basic local user access is required.

UI:NUser interaction, none

The attacker performs every step itself — creating the socket, binding, and racing setsockopt — with no victim action or cooperation needed at any point.

S:UScope, unchanged

The corruption stays within the kernel's own memory and security authority, giving standard local privilege escalation rather than crossing a VM, IOMMU, or sandbox boundary.

C:HConfidentiality impact, high

Losing the ro->bound update makes raw_release() skip raw_disable_allfilters(), leaving a receiver entry holding a raw sk pointer that can_rx_register() never refcounted; later frames drive raw_rcv() to read fd_frames, xl_frames, raw_vcid_opts and count out of freed memory, and the resulting UAF lets an attacker groom the freed slab to disclose kernel memory.

I:HIntegrity impact, high

The same dangling socket gives write primitives: raw_rcv() writes through this_cpu_ptr(ro->uniq) into already free_percpu'd memory and calls sock_queue_rcv_skb() on the freed sock, so a heap-sprayed replacement object yields attacker-influenced writes and control-flow hijack potential.

A:HAvailability impact, high

The use-after-free reliably oopses or panics the kernel when CAN frames hit the stale receiver entry, and the clobber also skips netdev_put() (leaking a device reference that hangs unregistration) and can drive can_rx_unregister() into its "receive list entry not found" error path.