huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2026-29775: freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId
Component: freerdp
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2026-03-13T17:28:39.641000+00:00

A heap based buffer overflow flaw has been discovered in FreeRDP. This client-side heap out-of-bounds read/write occurs in FreeRDP's bitmap cache subsystem due to an off-by-one boundary check in bitmap_cache_put. A malicious server can send a CACHE_BITMAP_ORDER (Rev1) with cacheId equal to maxCells, bypassing the guard and accessing cells[] one element past the allocated array. A malicious server can trigger a client-side heap out-of-bounds access (READ of 4 bytes, followed by potential WRITE of a pointer) on the bitmap cache cells array, causing a crash (DoS) and heap corruption. The off-by-one accesses cells[maxCells] which reads from and writes to adjacent heap memory, potentially enabling pointer overwrite for code execution depending on heap layout.


Affected upstream versions: < 3.24.0
Fixed upstream versions: 3.24.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: ffad58fd2b329efd81a3239e9d7e3c927b8e503f
CVE-2026-29785: github.com/nats-io/nats-server: NATS-Server: Denial of Service via leafnode compression
Component: github.com/nats-io/nats-server
Severity: Important
CWE: CWE-409 (Improper Handling of Highly Compressed Data (Data Amplification))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-03-25T19:38:44.587000+00:00

A flaw was found in NATS-Server. A remote attacker can exploit this vulnerability by connecting to a NATS-Server instance where the 'leafnode' configuration is enabled and compression is active. This pre-authentication flaw allows the attacker to trigger a server crash, resulting in a Denial of Service (DoS) for the affected system.


Affected upstream versions: < 2.11.14, >= 2.12.0-RC.1, < 2.12.5
Fixed upstream versions: v2.12.5
Upstream repository: https://github.com/nats-io/nats-server
Upstream fix commit: a1488de6f2ba6e666aef0f9cce0016f7f167d6a8
CVE-2026-3082: gstreamer-plugins-bad: GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser
Component: gstreamer-plugins-bad
Severity: Important
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2026-03-13T20:39:33.772000+00:00

A flaw was found in GStreamer. A remote attacker can exploit a heap-based buffer overflow vulnerability in the GStreamer JPEG parser by providing a specially crafted JPEG file. This issue is caused by improper validation of Huffman table lengths, which can lead to arbitrary code execution in the context of the current process.

Statement: This is an IMPORTANT heap-based buffer overflow vulnerability in the GStreamer JPEG parser. The flaw allows remote code execution when processing a specially crafted JPEG file due to improper validation of Huffman table lengths. Red Hat products utilizing GStreamer to process untrusted JPEG content are affected.

Affected upstream versions: 1c6e163aa33962f5ee4a87d29319ccdd5cb67612
Fixed upstream versions: 1.29.1
Upstream repository: https://gitlab.freedesktop.org/gstreamer/gstreamer
Upstream fix commit: 7d3c258ed928cf59d126c8ea926b185f046f444c
CVE-2026-30827: express-rate-limit: express-rate-limit: Denial of Service for IPv4 clients due to incorrect IPv6 subnet masking
Component: express-rate-limit
Severity: Moderate
CWE: CWE-1389 (Incorrect Parsing of Numbers with Different Radices)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-03-07T05:19:08.206000+00:00

A flaw was found in express-rate-limit. The default key generator incorrectly applies IPv6 subnet masking to IPv4-mapped IPv6 addresses, which are used when an IPv4 client connects to a dual-stack server. This misconfiguration causes all IPv4 traffic to be treated as a single entity for rate limiting. Consequently, a remote attacker can exhaust the rate limit with a single client, leading to a Denial of Service (DoS) for all other IPv4 clients by causing them to receive HTTP 429 errors.


Affected upstream versions: >= 8.0.0, < 8.0.2, >= 8.1.0, < 8.1.1, >= 8.2.0, < 8.2.2
Fixed upstream versions: v8.3.0
Upstream repository: https://github.com/express-rate-limit/express-rate-limit
Upstream fix commit: 14e53888cdfd1b9798faf5b634c4206409e27fc4
CVE-2026-3083: gstreamer-plugins-good: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay
Component: gstreamer-plugins-good
Severity: Important
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2026-03-13T20:41:31.185000+00:00

A flaw was found in GStreamer. This out-of-bounds write vulnerability exists within the `rtpqdm2depay` element, specifically during the processing of X-QDM Real-time Transport Protocol (RTP) payload elements. A remote attacker can exploit this by providing malformed user-supplied data to the `packetid` element, leading to a write past the end of an allocated array. Successful exploitation can result in arbitrary code execution in the context of the current process.

Statement: This IMPORTANT vulnerability in GStreamer allows remote code execution due to an out-of-bounds write when processing X-QDM RTP payload elements. Red Hat products using GStreamer for RTP stream handling are affected if they process untrusted media streams.

Affected upstream versions: 1c6e163aa33962f5ee4a87d29319ccdd5cb67612
Fixed upstream versions: 1.29.1
Upstream repository: https://gitlab.freedesktop.org/gstreamer/gstreamer
Upstream fix commit: d60a94dee3c0a0942c9981491bf83e0de1900fbf
CVE-2026-3085: gstreamer-plugins-good: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay
Component: gstreamer-plugins-good
Severity: Important
CWE: CWE-1284 (Improper Validation of Specified Quantity in Input)
CVSS v3: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2026-03-13T20:40:02.186000+00:00

A flaw was found in GStreamer. This heap-based buffer overflow vulnerability in the rtpqdm2depay component allows a remote attacker to execute arbitrary code. The flaw occurs due to insufficient validation of user-supplied data length during the processing of X-QDM Real-time Transport Protocol (RTP) payloads. Successful exploitation can lead to remote code execution within the context of the current process.

Statement: This is an IMPORTANT vulnerability in the GStreamer rtpqdm2depay plugin. The flaw enables remote code execution through a heap-based buffer overflow when processing specially crafted X-QDM RTP payloads. Exploitation requires an application to interact with the vulnerable GStreamer library to process such untrusted media streams.

Affected upstream versions: 1c6e163aa33962f5ee4a87d29319ccdd5cb67612
Fixed upstream versions: 1.29.1
Upstream repository: https://gitlab.freedesktop.org/gstreamer/gstreamer
Upstream fix commit: d60a94dee3c0a0942c9981491bf83e0de1900fbf
CVE-2026-30892: crun: crun: Privilege escalation due to incorrect parsing of the `--user` option
Component: crun
Severity: Moderate
CWE: CWE-115 (Misinterpretation of Input)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-03-25T23:57:01.741000+00:00

A flaw was found in crun, an open-source OCI Container Runtime. A local user can exploit this vulnerability due to incorrect parsing of the `--user` option when using `crun exec`. The value `1` is misinterpreted as root privileges (User ID 0 and Group ID 0) instead of the intended User ID 1 and Group ID 0. This allows a process to run with higher privileges than expected, leading to privilege escalation.

Statement: Red Hat has rated this vulnerability as Moderate because the flaw exists in the OCI container runtime crun. When crun exec -u 1 is used, crun incorrectly interprets UID 1 as UID 0 (root), causing the executed process to run with root privileges inside the container instead of as the intended unprivileged user.

Successful exploitation requires local access to container management operations. An attacker must already have the ability to invoke crun exec against an existing container. The vulnerability is not remotely exploitable and cannot be triggered by an unauthenticated attacker.

Additionally, the privilege escalation is limited to the container context. While the flaw allows an attacker to obtain root privileges within the affected container, there is no demonstrated container escape or direct compromise of the host system resulting from this issue alone.

Affected upstream versions: >= 1.19, < 1.27
Fixed upstream versions: 1.27
Upstream repository: https://github.com/containers/crun
Upstream fix commit: 1bd7f42446999b0e76bc3d575392e05c943b0b01
CVE-2026-30922: pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion
Component: pyasn1
Severity: Important
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-03-18T02:29:45.857000+00:00

An unbounded recursion flaw has been discovered in the pypi pyasn1 library. This uncontrolled recursion occurs when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing nested SEQUENCE (0x30) or SET (0x31) tags with Indefinite Length (0x80) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a RecursionError or consumes all available memory (OOM), crashing the host application.


Affected upstream versions: < 0.6.3
Upstream repository: https://github.com/pyasn1/pyasn1
Upstream fix commit: 25ad481c19fdb006e20485ef3fc2e5b3eff30ef0
CVE-2026-31402: kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
Component: kernel
Severity: Important
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-04-03T00:00:00+00:00

A flaw was found in the Linux kernel's NFSv4.0 server (nfsd). A remote, unauthenticated attacker can exploit this heap overflow vulnerability in the NFSv4.0 LOCK replay cache. By using two cooperating NFSv4.0 clients, where one sets a lock with a large owner string and another requests a conflicting lock, the attacker can trigger a slab-out-of-bounds write. This corruption of adjacent heap memory could lead to arbitrary code execution or a denial of service.

Statement: This Important flaw in the Linux kernel's NFSv4.0 server (nfsd) allows a heap overflow. In this flaw a local attacker can trigger this by orchestrating two NFSv4.0 clients to create a conflicting lock with an oversized owner string.

Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 5.10.253, 5.15.210, 6.1.167, 6.12.78, 6.18.20, 6.19.10, 6.6.130, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f9fcb4441f6c02bb20c2eb340101e27dfe23607c
CVE-2026-31408: kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold
Component: kernel
Severity: Moderate
CWE: CWE-911 (Improper Update of Reference Count)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-04-06T00:00:00+00:00

A flaw was found in the Linux kernel's Bluetooth SCO (Synchronous Connection-Oriented) protocol implementation. The `sco_recv_frame()` function fails to properly hold a reference to a socket after releasing a lock. This oversight allows a concurrent operation to free the socket while it is still being accessed, leading to a use-after-free vulnerability. A local attacker could potentially exploit this to cause memory corruption or a denial of service.

Statement: Under `sco_conn_lock`, the code read `conn->sk` then dropped the lock without `sco_sock_hold()`, so `close()` could race and free the socket before `sk->sk_state` use. The fix mirrors other SCO helpers. Adjacent Bluetooth is involved; impact is UAF and likely crash.

Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 5.15.203, 6.1.168, 6.12.80, 6.18.21, 6.19.11, 6.6.131, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d57384e27d1ebf0047e3f00a6e1181b8be9857a2
CVE-2026-31411: kernel: net: atm: fix crash due to unvalidated vcc pointer in sigd_send()
Component: kernel
Severity: Moderate
CWE: CWE-822 (Untrusted Pointer Dereference)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2026-04-08T00:00:00+00:00

A flaw was found in the Linux kernel's Asynchronous Transfer Mode (ATM) networking component. A local attacker, by acting as a malicious signaling daemon, could send a specially crafted message containing an unvalidated pointer. This unvalidated pointer would be directly used by the kernel, leading to the dereference of an arbitrary memory address. The consequence is a system crash, resulting in a Denial of Service (DoS).


Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 5.10.252, 5.15.202, 6.1.165, 6.12.75, 6.18.14, 6.19.4, 6.6.128, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c96549d07dfdd51aadf0722cfb40711574424840
CVE-2026-31419: kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-04-13T00:00:00+00:00

A flaw was found in the Linux kernel's bonding driver. A local attacker with low privileges could exploit a use-after-free vulnerability in the `bond_xmit_broadcast()` function. This occurs due to a race condition during concurrent slave enslave/release operations, which can lead to the original socket buffer (skb) being double-freed. Successful exploitation of this flaw can result in a system crash, leading to a denial of service.

Statement: This is an Important impact flaw affecting the Linux kernel's bonding driver in Red Hat Enterprise Linux 6, 8.8 and later, 9.2 and later, and 10, as well as Red Hat In-Vehicle OS 2.0. A local attacker with low privileges could trigger a use-after-free vulnerability, leading to a system crash and denial of service. Red Hat Enterprise Linux 7, 8.2, 8.4, 8.6, and 9.0 are not affected as the vulnerable code is not present.

Affected upstream versions: 5.10.94 < 5.11, 5.15.17 < 5.16, 5.16.3 < 5.17, 5.17
Fixed upstream versions: 0, 5.11, 5.16, 5.17, 6.12.95, 6.18.22, 6.19.12, 6.6.143, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2de5c8eea0a9db99dae7c36f4b541b74b41d3a04
CVE-2026-31431: kernel: crypto: algif_aead - Revert to operating out-of-place
Component: kernel
Severity: Important
CWE: CWE-1288 (Improper Validation of Consistency within Input)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-04-22T00:00:00+00:00

A flaw was found in the Linux kernel's algif_aead cryptographic algorithm interface. An incorrect in-place operation causes source and destination data mappings to differ during cryptographic processing. A low-privileged local attacker can exploit this flaw to corrupt the contents of sensitive system files and escalate to root privileges.

Statement: This issue is classified as Important, rather than Critical severity, because exploitation requires local access to the system. A low-privileged local attacker can exploit this flaw in the Linux kernel's cryptographic interface to gain root privileges by overwriting sensitive system files. Exploitation does not require user interaction, potentially resulting in full compromise of confidentiality, integrity, and availability.

Affected upstream versions: 4.14
Fixed upstream versions: 0, 5.10.254, 5.15.204, 6.1.170, 6.12.85, 6.18.22, 6.19.12, 6.6.137, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 893d22e0135fa394db81df88697fba6032747667
CVE-2026-31467: kernel: Linux kernel: Denial of Service in erofs filesystem
Component: kernel
Severity: Moderate
CWE: CWE-833 (Deadlock)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-04-22T00:00:00+00:00

A flaw was found in the Linux kernel's erofs filesystem. A remote attacker can exploit this vulnerability without requiring any privileges. This issue occurs when insufficient memory during a memory mapping operation (vm_map_ram()) in the bio completion path leads to a deadlock, causing a Denial of Service (DoS).


Affected upstream versions: 5.13
Fixed upstream versions: 0, 5.15.203, 6.1.168, 6.12.80, 6.18.21, 6.19.11, 6.6.131, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d6565ea662e17d45a577184b0011bd69de22dc2b
CVE-2026-31474: kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg()
Component: kernel
Severity: Important
CWE: CWE-364 (Signal Handler Race Condition)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-04-22T00:00:00+00:00

A flaw was found in the Linux kernel's Controller Area Network (CAN) ISO-TP (isotp) module. This vulnerability, known as a use-after-free, occurs when the system attempts to free a memory region while it is still being used. A local attacker could trigger this condition by sending a signal that interrupts a specific waiting process during a close operation. This can lead to memory corruption, potentially causing the system to crash (denial of service) or behave unpredictably.

Statement: This is an Important use-after-free flaw in the Linux kernel's Controller Area Network (CAN) ISO-TP module. A local attacker can trigger this vulnerability by interrupting a specific waiting process, potentially leading to memory corruption and system instability or denial of service. The impact is significant due to the potential for system compromise from a local user.

Affected upstream versions: 6.4
Fixed upstream versions: 0, 6.12.80, 6.18.21, 6.19.11, 6.6.131, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: cb3d6efa78460e6d50bf68806d0db66265709f64
CVE-2026-31488: kernel: drm/amd/display: Do not skip unrelated mode changes in DSC validation
Component: kernel
Severity: Important
CWE: CWE-1288 (Improper Validation of Consistency within Input)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-04-22T00:00:00+00:00

A flaw was found in the Linux kernel's AMD display component. This vulnerability arises from incorrect validation of display mode changes during Display Stream Compression (DSC) processing. A local attacker could exploit this by initiating specific display configuration changes, which may lead to a memory leak and a use-after-free error. This could result in system crashes, denial of service, or potentially allow the attacker to gain elevated privileges.

Statement: This is an Important flaw in the Linux kernel's AMD display driver, where incorrect handling of display mode changes during Display Stream Compression (DSC) processing can lead to a memory leak and use-after-free. A local attacker with the ability to initiate specific display configuration changes could exploit this to cause a denial of service or potentially escalate privileges. The vulnerability requires local access to the system.

Affected upstream versions: 5.18
Fixed upstream versions: 0, 6.1.175, 6.12.80, 6.18.21, 6.19.11, 6.6.140, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: da1d0ed31e9802fd99384f43cc63678a5a11cb41
CVE-2026-31530: kernel: cxl/port: Fix use after free of parent_port in cxl_detach_ep()
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-04-22T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

cxl/port: Fix use after free of parent_port in cxl_detach_ep()

cxl_detach_ep() is called during bottom-up removal when all CXL memory
devices beneath a switch port have been removed. For each port in the
hierarchy it locks both the port and its parent, removes the endpoint,
and if the port is now empty, marks it dead and unregisters the port
by calling delete_switch_port(). There are two places during this work
where the parent_port may be used after freeing:

First, a concurrent detach may have already processed a port by the
time a second worker finds it via bus_find_device(). Without pinning
parent_port, it may already be freed when we discover port->dead and
attempt to unlock the parent_port. In a production kernel that's a
silent memory corruption, with lock debug, it looks like this:

[]DEBUG_LOCKS_WARN_ON(__owner_task(owner) != get_current())
[]WARNING: kernel/locking/mutex.c:949 at __mutex_unlock_slowpath+0x1ee/0x310
[]Call Trace:
[]mutex_unlock+0xd/0x20
[]cxl_detach_ep+0x180/0x400 [cxl_core]
[]devm_action_release+0x10/0x20
[]devres_release_all+0xa8/0xe0
[]device_unbind_cleanup+0xd/0xa0
[]really_probe+0x1a6/0x3e0

Second, delete_switch_port() releases three devm actions registered
against parent_port. The last of those is unregister_port() and it
calls device_unregister() on the child port, which can cascade. If
parent_port is now also empty the device core may unregister and free
it too. So by the time delete_switch_port() returns, parent_port may
be free, and the subsequent device_unlock(&parent_port->dev) operates
on freed memory. The kernel log looks same as above, with a different
offset in cxl_detach_ep().

Both of these issues stem from the absence of a lifetime guarantee
between a child port and its parent port.

Establish a lifetime rule for ports: child ports hold a reference to
their parent device until release. Take the reference when the port
is allocated and drop it when released. This ensures the parent is
valid for the full lifetime of the child and eliminates the use after
free window in cxl_detach_ep().

This is easily reproduced with a reload of cxl_acpi in QEMU with CXL
devices present.


Affected upstream versions: 6.3
Fixed upstream versions: 0, 6.12.80, 6.18.21, 6.19.11, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d216a4bd138eb57cc4ae7c43b2f709e3482af7e2
CVE-2026-31532: kernel: can: raw: fix ro->uniq use-after-free in raw_rcv()
Component: kernel
Severity: Moderate
CWE: CWE-366 (Race Condition within a Thread)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2026-04-23T00:00:00+00:00

A flaw was found in the Linux kernel's Controller Area Network (CAN) raw socket implementation. A use-after-free vulnerability can occur due to a timing window during the unregistration of CAN receive filters, allowing a freed memory region to be accessed. This could lead to system instability or a denial of service (DoS).

Statement: A use-after-free flaw in the Linux kernel CAN raw socket implementation can occur when raw_release() frees the per-CPU ro->uniq storage before RCU-deferred receive callbacks have fully drained. A local attacker able to create raw CAN sockets and trigger CAN receive activity could race socket teardown with raw_rcv() and cause a kernel crash. The likely impact is denial of service, while privilege escalation would require additional, unproven control over per-CPU memory reuse.
The issue appears more consistent with an RCU lifetime/race-condition bug leading primarily to denial of service, as exploitation depends on a narrow teardown race involving a percpu object rather than a generic reclaimable slab object, with no demonstrated privilege-escalation path or obvious controlled overwrite primitive in the relatively niche CAN raw socket subsystem.

Affected upstream versions: 4.1
Fixed upstream versions: 0, 5.10.258, 5.15.209, 6.1.175, 6.12.83, 6.18.24, 6.19.14, 6.6.136, 7.0.1, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1de30576a6dfeaaa27ef91fa272e6b9240b6fbd3