The SocketCAN implementation validates the length of a user-provided buffer containing a socketcan_frame object using only a NET_ASSERT statement in zcan_sendto_ctx() before dereferencing it in socketcan_to_can_frame(). In production builds where assertions are disabled, a userspace application that controls the length passed to a sendto syscall can supply an incomplete or truncated frame, causing socketcan_to_can_frame() to dereference fields beyond the end of the buffer. This results in an out-of-bounds read that can cause denial-of-service crashes or, because the parsed frame contents are transmitted on the network, leak adjacent memory.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
References
History
Sat, 30 May 2026 08:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The SocketCAN implementation validates the length of a user-provided buffer containing a socketcan_frame object using only a NET_ASSERT statement in zcan_sendto_ctx() before dereferencing it in socketcan_to_can_frame(). In production builds where assertions are disabled, a userspace application that controls the length passed to a sendto syscall can supply an incomplete or truncated frame, causing socketcan_to_can_frame() to dereference fields beyond the end of the buffer. This results in an out-of-bounds read that can cause denial-of-service crashes or, because the parsed frame contents are transmitted on the network, leak adjacent memory. | |
| Title | can: Local Denial of Service via SocketCAN Send | |
| Weaknesses | CWE-125 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: zephyr
Published:
Updated: 2026-05-30T07:15:56.417Z
Reserved: 2026-03-27T23:41:28.910Z
Link: CVE-2026-5071
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-05-30T08:16:16.370
Modified: 2026-05-30T08:16:16.370
Link: CVE-2026-5071
Redhat
No data.
OpenCVE Enrichment
No data.