CVE-2026-5071
6.1 MEDIUMThe SocketCAN implementation validates the length of a user-provided buffer containing a socketcan_frame object using only a NET_ASSERT s...
Published: 2026-05-30 · Last updated: 2026-06-01
Severity and scoring
- CVSS
- 6.1 MEDIUM
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
- CWE
- CWE-125
Description
The SocketCAN implementation validates the length of a user-provided buffer containing a socketcan_frame object using only a NET_ASSERT statement in zcan_sendto_ctx() before dereferencing it in socketcan_to_can_frame(). In production builds where assertions are disabled, a userspace application that controls the length passed to a sendto syscall can supply an incomplete or truncated frame, causing socketcan_to_can_frame() to dereference fields beyond the end of the buffer. This results in an out-of-bounds read that can cause denial-of-service crashes or, because the parsed frame contents are transmitted on the network, leak adjacent memory.
Source: NVD
References
Related CVEs
Same CWE
- CVE-2026-1765 — A flaw was found in the `tracker-extract-mp3` component of GNOME localsearch (previously known as tracker-miners) (5.6 MEDIUM)
- CVE-2026-1764 — A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor (5.6 MEDIUM)
- CVE-2026-12087 — Socket versions before 2.041 for Perl have an out-of-bounds heap read
- CVE-2026-53704 — A flaw was found in GStreamer's RealMedia demuxer in the gst-plugins-ugly package (7.1 HIGH)
- CVE-2026-53703 — A vulnerability was found in the GStreamer RealMedia demuxer (gst-plugins-ugly) (7.1 HIGH)