A use‑after‑free bug exists in the Linux kernel CAN raw handling. When a raw socket is released, its per‑CPU uniq storage can be freed before the RCU callback finishes, allowing a subsequent read operation to dereference a freed pointer. An attacker who can inject crafted CAN frames into the raw interface could exploit this race to read or overwrite kernel memory, potentially executing arbitrary code. The flaw is classified as CWE‑366 and CWE‑416.

All Linux kernel builds that include CAN raw support and have not applied the patch referenced in commit a535a9217ca3f2fccedaafb2fddb4c48f27d36dc are affected. No specific kernel versions are listed in the advisory, so any unsupported kernel that still contains the vulnerable code path is potentially impacted.

The CVSS score of 7.8 indicates high severity. However, the EPSS score of less than 1% and the absence from the CISA KEV catalog suggest the exploitation likelihood is low at present. The vulnerability is local to the system, requiring the ability to write to a CAN raw device; an attacker would need sufficient privileges or access to the CAN bus interface to trigger the race condition.