{ "schema_version": "1.6.1", "id": "RPI-CVE-2026-68387", "modified": "2026-10-09T11:39:44Z", "upstream": [ "CVE-2026-68387" ], "published": "2026-08-10T12:08:00Z", "summary": "can: raw: add locking for raw flags bitfield", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: raw: add locking for raw flags bitfield\n\nWith commit 890e5198a6e5 (\"can: raw: use bitfields to store flags in\nstruct raw_sock\") the formerly separate integer values have been integrated\ninto a single bitfield. This led to a read-modify-write operation when\nchanging a flag in raw_setsockopt() which now needs a locking to prevent\nconcurrent access.\n\nInstead of adding a lock/unlock hell in each of the flag manipulations this\npatch introduces a wrapper for a new raw_setsockopt_locked() function\nanalogue to the isotp_setsockopt[_locked]() approach in net/can/isotp.c\n\n[mkl: use Closes tag instead of Link]", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:13", "name": "linux" }, "versions": [ "1:6.18.29-1+rpt1", "1:6.18.33-1+rpt1", "1:6.18.34-1+rpt1", "1:6.18.39-1+rpt1" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.18.29+rpt-rpi-2712", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v6", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v7", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v8", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v8-rt", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-2712", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v6", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v7", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v8", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v8-rt", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-2712", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v6", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v7", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v8", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v8-rt", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-2712", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v6", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v7", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v8", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v8-rt", "binary_version": "1:6.18.39-1+rpt1" } ] }, "database_specific": { "per_version": { "1:6.18.29-1+rpt1": { "linux_commit": "66318c5b5cd8145a662303af12ed39ac07eb27cc", "upstream_version": "6.18.29", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.42" }, "1:6.18.33-1+rpt1": { "linux_commit": "95b85bebbedcaedfa7ca79116ed38b7376fba412", "upstream_version": "6.18.33", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.42" }, "1:6.18.34-1+rpt1": { "linux_commit": "c8c7494100e99ee05b11aaa4f0588a223a63d1af", "upstream_version": "6.18.34", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.42" }, "1:6.18.39-1+rpt1": { "linux_commit": "60ea684a8ace97bb0db1a16e20753bdd6ab371ff", "upstream_version": "6.18.39", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.42" } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68387" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/00ba4bf8798242253fefc1fa6a78db1d445fd024" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/57791aab1129c9405f84bb0882de58967d8b44cd" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/1e5185c090589f4146d728ab36417d8a5419f127" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-08-17T05:24:08Z", "severity": { "source": "kernel CNA", "cvss_v3_score": 7.8, "cvss_v3_severity": "High", "scenario": "AV:L - The race is driven entirely through local syscalls on an AF_CAN/CAN_RAW socket \u2014 one thread calling bind() while another calls setsockopt(SOL_CAN_RAW, CAN_RAW_LOOPBACK). No network packet is needed to trigger the corruption, so the attack vector is local.\nAC:L - The attacker controls both sides of the race, holding the same fd and issuing concurrent bind()/setsockopt() from two threads it pins itself, and can loop the attempt indefinitely until the unlocked read-modify-write on the shared bitfield word loses the update to ro->bound. No condition lies outside attacker control.\nPR:L - can_create() and raw_proto impose no capability check, so any unprivileged local user can open a CAN_RAW socket; a user namespace (unshare -Urn) additionally lets an unprivileged attacker create a vcan device to bind to, so only basic local user access is required.\nUI:N - The attacker performs every step itself \u2014 creating the socket, binding, and racing setsockopt \u2014 with no victim action or cooperation needed at any point.\nS:U - The corruption stays within the kernel's own memory and security authority, giving standard local privilege escalation rather than crossing a VM, IOMMU, or sandbox boundary.\nC:H - Losing the ro->bound update makes raw_release() skip raw_disable_allfilters(), leaving a receiver entry holding a raw sk pointer that can_rx_register() never refcounted; later frames drive raw_rcv() to read fd_frames, xl_frames, raw_vcid_opts and count out of freed memory, and the resulting UAF lets an attacker groom the freed slab to disclose kernel memory.\nI:H - The same dangling socket gives write primitives: raw_rcv() writes through this_cpu_ptr(ro->uniq) into already free_percpu'd memory and calls sock_queue_rcv_skb() on the freed sock, so a heap-sprayed replacement object yields attacker-influenced writes and control-flow hijack potential.\nA:H - The use-after-free reliably oopses or panics the kernel when CAN frames hit the stale receiver entry, and the clobber also skips netdev_put() (leaking a device reference that hangs unregistration) and can drive can_rx_unregister() into its \"receive list entry not found\" error path." } } }