GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-68387 (GCVE-0-2026-68387)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:04 – Updated: 2026-08-17 05:04
VLAI
Title
can: raw: add locking for raw flags bitfield
Summary
In the Linux kernel, the following vulnerability has been resolved: can: raw: add locking for raw flags bitfield With commit 890e5198a6e5 ("can: raw: use bitfields to store flags in struct raw_sock") the formerly separate integer values have been integrated into a single bitfield. This led to a read-modify-write operation when changing a flag in raw_setsockopt() which now needs a locking to prevent concurrent access. Instead of adding a lock/unlock hell in each of the flag manipulations this patch introduces a wrapper for a new raw_setsockopt_locked() function analogue to the isotp_setsockopt[_locked]() approach in net/can/isotp.c [mkl: use Closes tag instead of Link]
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 890e5198a6e5b238627c245fafea1a92670a86cd , < 00ba4bf8798242253fefc1fa6a78db1d445fd024 (git)
Affected: 890e5198a6e5b238627c245fafea1a92670a86cd , < 57791aab1129c9405f84bb0882de58967d8b44cd (git)
Affected: 890e5198a6e5b238627c245fafea1a92670a86cd , < 1e5185c090589f4146d728ab36417d8a5419f127 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.18
Unaffected: 0 , < 6.18 (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/can/raw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "00ba4bf8798242253fefc1fa6a78db1d445fd024",
              "status": "affected",
              "version": "890e5198a6e5b238627c245fafea1a92670a86cd",
              "versionType": "git"
            },
            {
              "lessThan": "57791aab1129c9405f84bb0882de58967d8b44cd",
              "status": "affected",
              "version": "890e5198a6e5b238627c245fafea1a92670a86cd",
              "versionType": "git"
            },
            {
              "lessThan": "1e5185c090589f4146d728ab36417d8a5419f127",
              "status": "affected",
              "version": "890e5198a6e5b238627c245fafea1a92670a86cd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/can/raw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: raw: add locking for raw flags bitfield\n\nWith commit 890e5198a6e5 (\"can: raw: use bitfields to store flags in\nstruct raw_sock\") the formerly separate integer values have been integrated\ninto a single bitfield. This led to a read-modify-write operation when\nchanging a flag in raw_setsockopt() which now needs a locking to prevent\nconcurrent access.\n\nInstead of adding a lock/unlock hell in each of the flag manipulations this\npatch introduces a wrapper for a new raw_setsockopt_locked() function\nanalogue to the isotp_setsockopt[_locked]() approach in net/can/isotp.c\n\n[mkl: use Closes tag instead of Link]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The race is driven entirely through local syscalls on an AF_CAN/CAN_RAW socket \u2014 one thread calling bind() while another calls setsockopt(SOL_CAN_RAW, CAN_RAW_LOOPBACK). No network packet is needed to trigger the corruption, so the attack vector is local.\nAC:L - The attacker controls both sides of the race, holding the same fd and issuing concurrent bind()/setsockopt() from two threads it pins itself, and can loop the attempt indefinitely until the unlocked read-modify-write on the shared bitfield word loses the update to ro-\u003ebound. No condition lies outside attacker control.\nPR:L - can_create() and raw_proto impose no capability check, so any unprivileged local user can open a CAN_RAW socket; a user namespace (unshare -Urn) additionally lets an unprivileged attacker create a vcan device to bind to, so only basic local user access is required.\nUI:N - The attacker performs every step itself \u2014 creating the socket, binding, and racing setsockopt \u2014 with no victim action or cooperation needed at any point.\nS:U - The corruption stays within the kernel\u0027s own memory and security authority, giving standard local privilege escalation rather than crossing a VM, IOMMU, or sandbox boundary.\nC:H - Losing the ro-\u003ebound update makes raw_release() skip raw_disable_allfilters(), leaving a receiver entry holding a raw sk pointer that can_rx_register() never refcounted; later frames drive raw_rcv() to read fd_frames, xl_frames, raw_vcid_opts and count out of freed memory, and the resulting UAF lets an attacker groom the freed slab to disclose kernel memory.\nI:H - The same dangling socket gives write primitives: raw_rcv() writes through this_cpu_ptr(ro-\u003euniq) into already free_percpu\u0027d memory and calls sock_queue_rcv_skb() on the freed sock, so a heap-sprayed replacement object yields attacker-influenced writes and control-flow hijack potential.\nA:H - The use-after-free reliably oopses or panics the kernel when CAN frames hit the stale receiver entry, and the clobber also skips netdev_put() (leaking a device reference that hangs unregistration) and can drive can_rx_unregister() into its \"receive list entry not found\" error path."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:04:34.632Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/00ba4bf8798242253fefc1fa6a78db1d445fd024"
        },
        {
          "url": "https://git.kernel.org/stable/c/57791aab1129c9405f84bb0882de58967d8b44cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/1e5185c090589f4146d728ab36417d8a5419f127"
        }
      ],
      "title": "can: raw: add locking for raw flags bitfield",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68387",
    "datePublished": "2026-08-10T12:04:06.326Z",
    "dateReserved": "2026-07-30T09:28:09.388Z",
    "dateUpdated": "2026-08-17T05:04:34.632Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68387",
      "date": "2026-09-16",
      "epss": "0.00173",
      "percentile": "0.07051"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68387\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-10T13:20:31.950\",\"lastModified\":\"2026-08-17T06:17:47.277\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncan: raw: add locking for raw flags bitfield\\n\\nWith commit 890e5198a6e5 (\\\"can: raw: use bitfields to store flags in\\nstruct raw_sock\\\") the formerly separate integer values have been integrated\\ninto a single bitfield. This led to a read-modify-write operation when\\nchanging a flag in raw_setsockopt() which now needs a locking to prevent\\nconcurrent access.\\n\\nInstead of adding a lock/unlock hell in each of the flag manipulations this\\npatch introduces a wrapper for a new raw_setsockopt_locked() function\\nanalogue to the isotp_setsockopt[_locked]() approach in net/can/isotp.c\\n\\n[mkl: use Closes tag instead of Link]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/can/raw.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"890e5198a6e5b238627c245fafea1a92670a86cd\",\"lessThan\":\"00ba4bf8798242253fefc1fa6a78db1d445fd024\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"890e5198a6e5b238627c245fafea1a92670a86cd\",\"lessThan\":\"57791aab1129c9405f84bb0882de58967d8b44cd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"890e5198a6e5b238627c245fafea1a92670a86cd\",\"lessThan\":\"1e5185c090589f4146d728ab36417d8a5419f127\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/can/raw.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.42\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/00ba4bf8798242253fefc1fa6a78db1d445fd024\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/1e5185c090589f4146d728ab36417d8a5419f127\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/57791aab1129c9405f84bb0882de58967d8b44cd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-31T11:45:24+00:00",
      "cve": "CVE-2026-68387",
      "id": "CVE-2026-68387",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_not_affected": "277",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: can: raw: add locking for raw flags bitfield",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68387.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-13T01:28:01Z",
      "cve": "CVE-2026-68387",
      "id": "CVE-2026-68387",
      "initial_release_date": "2026-08-12T16:22:17Z",
      "product_status:known_not_affected": "296",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68387",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68387.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.