CVE-2026-80707

Received Received - Intake

CAN Bus J1939 Transport Buffer Initialization Flaw in Linux Kernel

Publication date: 2026-08-28

Last updated on: 2026-08-29

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer Zero the allocated buffer in j1939_session_fresh_new() to ensure it contains no residual data. While there is a potential performance impact if users allocate maximum sized ETP buffers, most real-world use cases are not noticeably affected since the maximum known buffer size is typically around 65K. [mkl: add Message-ID]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-29

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-80707

EUVD

EUVD-2026-67442

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the CAN (Controller Area Network) J1939 transport layer. The issue occurs in the function j1939_session_fresh_new(), where the receive buffer is not properly initialized. This could allow residual data from previous operations to remain in memory, potentially leading to information leaks or unexpected behavior.

Detection Guidance

This vulnerability is specific to the Linux kernel's CAN J1939 transport layer. Detection requires checking if the affected kernel code is present and if the buffer initialization issue exists. Examine kernel logs for CAN J1939 related errors or inspect the kernel source code for the function j1939_session_fresh_new(). No direct commands are provided in the context to detect this issue.

Impact Analysis

If exploited, this vulnerability could allow an attacker to access sensitive data that was previously stored in memory. It may also cause system instability or unexpected behavior in applications relying on the CAN J1939 transport layer. However, the impact is limited to systems using this specific kernel component.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or other common standards and regulations. The issue involves a buffer initialization flaw in the Linux kernel's CAN J1939 transport layer, which could potentially expose residual data but does not inherently impact data protection or privacy requirements.

Mitigation Strategies

Apply the latest Linux kernel patches that address this vulnerability. Update your kernel to a version where the buffer initialization in j1939_session_fresh_new() is corrected. Monitor vendor advisories for updates if using a distribution kernel.

Hi! I’m here to help you understand CVE-2026-80707. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70