CVE-2026-80706

Received Received - Intake

CAN Softing Firmware Record Length Validation Flaw

Publication date: 2026-08-28

Last updated on: 2026-08-29

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: can: softing: fw_parse(): validate firmware record spans fw_parse() reads a fixed record header, a firmware-provided payload, and a trailing checksum without knowing the end of the firmware blob. A truncated record can therefore make those reads exceed the blob. The same record also supplies addresses and lengths for writes into DPRAM. The generic loader uses wrap-prone mixed signed arithmetic for its bounds check, while the application loader does not bound the staging copy at all. Pass the firmware end to the parser and validate the full source record. Use a signed wide offset for generic DPRAM records and validate the application staging span against the mapped DPRAM before copying.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-29

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-80706

EUVD

EUVD-2026-67441

Affected Vendors & Products

Vendor	Product	Version / Range
linux	kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the CAN (Controller Area Network) softing driver's firmware parsing function. The issue occurs when the function reads firmware records without proper validation of the record spans, potentially leading to out-of-bounds reads if the firmware blob is truncated. Additionally, the function uses unsafe arithmetic for bounds checking when writing to DPRAM, which could allow memory corruption or crashes.

Detection Guidance

This vulnerability affects the Linux kernel's CAN (Controller Area Network) subsystem, specifically the softing driver. Detection requires checking kernel logs for errors related to CAN firmware parsing or DPRAM access. Monitor logs with 'dmesg | grep -i can' or 'journalctl -k | grep -i can'. If firmware parsing fails, errors like 'fw_parse: truncated record' may appear.

Impact Analysis

This vulnerability could allow an attacker with access to the system to cause a denial of service by crashing the kernel or potentially execute arbitrary code with kernel privileges. It may also lead to data corruption or instability in systems relying on CAN communication, such as automotive or industrial control systems.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a low-level Linux kernel driver issue involving firmware parsing and memory access. No evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve this issue. If immediate updating is not possible, disable the affected softing CAN driver by blacklisting it with 'echo 'blacklist softing' > /etc/modprobe.d/blacklist-softing.conf' and reboot. Avoid loading untrusted CAN firmware files.

Hi! I’m here to help you understand CVE-2026-80706. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70