CVE-2026-68387: can: raw: add locking for raw flags bitfield
In the Linux kernel, the following vulnerability has been resolved:
can: raw: add locking for raw flags bitfield
With commit 890e5198a6e5 ("can: raw: use bitfields to store flags in struct rawsock") the formerly separate integer values have been integrated into a single bitfield. This led to a read-modify-write operation when changing a flag in rawsetsockopt() which now needs a locking to prevent concurrent access.
Instead of adding a lock/unlock hell in each of the flag manipulations this patch introduces a wrapper for a new rawsetsockoptlocked() function analogue to the isotpsetsockoptlocked approach in net/can/isotp.c
[mkl: use Closes tag instead of Link]
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel can: rawto a version that resolves this vulnerability.Patch 890e5198a6e5
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68387?
CVE-2026-68387 has a risk rating of 27, indicating a moderate level of severity.
How do I fix CVE-2026-68387?
To resolve CVE-2026-68387, update the Linux kernel to the latest version where the vulnerability has been patched.
What systems are affected by CVE-2026-68387?
CVE-2026-68387 impacts systems running affected versions of the Linux kernel that utilize the CAN raw socket interface.
Is CVE-2026-68387 a remote attack vulnerability?
CVE-2026-68387 does not provide a remote attack vector and typically requires local access to exploit.
What type of flaw is described in CVE-2026-68387?
CVE-2026-68387 involves a locking issue related to the raw flags bitfield in the Linux kernel CAN subsystem.