High 7.8Published Aug 10, 2026

CVE-2026-68387can: raw: add locking for raw flags bitfield

Updated under an hour ago (2026-10-19 07:30 UTC)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: can: raw: add locking for raw flags bitfield With commit 890e5198a6e5 ("can: raw: use bitfields to store flags in struct raw_sock") the formerly separate integer values have been integrated into a single bitfield. This led to a read-modify-write operation when changing a flag in raw_setsockopt() which now needs a locking to prevent concurrent access. Instead of adding a lock/unlock hell in each of the flag manipulations this patch introduces a wrapper for a new raw_setsockopt_locked() function analogue to the isotp_setsockopt[_locked]() approach in net/can/isotp.c [mkl: use Closes tag instead of Link]

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Aug 17, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	890e5198a6e5b238627c245fafea1a92670a86cd builds before 00ba4bf8798242253fefc1fa6a78db1d445fd024; from 890e5198a6e5b238627c245fafea1a92670a86cd before 57791aab1129c9405f84bb0882de58967d8b44cd; 890e5198a6e5b238627c245fafea1a92670a86cd builds before 1e5185c090589f4146d728ab36417d8a5419f127	CNA record

References

https://git.kernel.org/stable/c/00ba4bf8798242253fefc1fa6a78db1d445fd024
https://git.kernel.org/stable/c/57791aab1129c9405f84bb0882de58967d8b44cd
https://git.kernel.org/stable/c/1e5185c090589f4146d728ab36417d8a5419f127

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.