Linux Kernel CVE-2026-31474

The vulnerability exists in the Linux kernel's ISO-TP (ISO 15765-2) Controller Area Network (CAN) protocol implementation, specifically in the socket transmission buffer management between isotp_sendmsg() and isotp_release() functions. The code uses compare-and-exchange (cmpxchg) for lock-free synchronization of so->tx.state but fails to protect the so->tx.buf memory allocation itself. When wait_event_interruptible() in isotp_release() receives a signal during ISOTP_SENDING state, the wait loop exits prematurely, allowing kfree(so->tx.buf) to execute while isotp_sendmsg() may still access the buffer in isotp_fill_dataframe(). This race condition creates a classic use-after-free scenario where one thread frees memory that another thread continues to reference. The ISO-TP protocol is used in automotive and industrial CAN bus communications for segmented message transmission, making this buffer particularly critical for maintaining multi-frame message integrity. The vulnerability demonstrates insufficient synchronization between socket lifecycle operations (close) and ongoing I/O operations (send), a common pattern in kernel socket implementations that require careful temporal coupling between resource deallocation and active users.