The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - can: raw: fix ro->uniq use-after-free in raw_rcv() raw_release() unregisters raw CAN receive filters via     can_rx_unregister(), but receiver deletion is deferred with call_rcu(). This leaves a window where     raw_rcv() may still be running in an RCU read-side critical section after raw_release() frees ro->uniq,     leading to a use-after-free of the percpu uniq storage. Move free_percpu(ro->uniq) out of raw_release()     and into a raw-specific socket destructor. can_rx_unregister() takes an extra reference to the socket and     only drops it from the RCU callback, so freeing uniq from sk_destruct ensures the percpu area is not     released until the relevant callbacks have drained. [mkl: applied manually] (CVE-2026-31532)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-31532

high Nessus Plugin ID 309985

Version 1.20