Vulnerability-Lookup

GHSA-Q4RV-GQHG-3PM9

Vulnerability from github – Published: 2026-08-28 09:31 – Updated: 2026-08-28 09:31

Details

In the Linux kernel, the following vulnerability has been resolved:

can: softing: fw_parse(): validate firmware record spans

fw_parse() reads a fixed record header, a firmware-provided payload, and a trailing checksum without knowing the end of the firmware blob. A truncated record can therefore make those reads exceed the blob.

The same record also supplies addresses and lengths for writes into DPRAM. The generic loader uses wrap-prone mixed signed arithmetic for its bounds check, while the application loader does not bound the staging copy at all.

Pass the firmware end to the parser and validate the full source record. Use a signed wide offset for generic DPRAM records and validate the application staging span against the mapped DPRAM before copying.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-80706"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-28T08:16:56Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: softing: fw_parse(): validate firmware record spans\n\nfw_parse() reads a fixed record header, a firmware-provided payload,\nand a trailing checksum without knowing the end of the firmware blob. A\ntruncated record can therefore make those reads exceed the blob.\n\nThe same record also supplies addresses and lengths for writes into\nDPRAM. The generic loader uses wrap-prone mixed signed arithmetic for its\nbounds check, while the application loader does not bound the staging\ncopy at all.\n\nPass the firmware end to the parser and validate the full source record.\nUse a signed wide offset for generic DPRAM records and validate the\napplication staging span against the mapped DPRAM before copying.",
  "id": "GHSA-q4rv-gqhg-3pm9",
  "modified": "2026-08-28T09:31:50Z",
  "published": "2026-08-28T09:31:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80706"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2ee477e541a6d5e434d6a4041c6b677ab42e1d82"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/808ed899dcf8bdef66894fda5eb7ee4bb0eb8dc1"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/84c850b08fc0d671c245144b619683129b55690a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/856d6cb04e5407523566b075841dcd6423757d1c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ad331e26fd213a19fee0de18cdacd67b7ff5b478"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ae588e5b9cc268de1aabf30f939f0870717ca164"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d0eac0ea7cf493e787fd7b4a556e43ef03cb4b50"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f6d9a6a9512430b395a1940d7b216394fd02d30b"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CVE-2026-80706 (GCVE-0-2026-80706)

Vulnerability from cvelistv5 – Published: 2026-08-28 06:53 – Updated: 2026-08-29 06:22

Title

can: softing: fw_parse(): validate firmware record spans

Summary

In the Linux kernel, the following vulnerability has been resolved: can: softing: fw_parse(): validate firmware record spans fw_parse() reads a fixed record header, a firmware-provided payload, and a trailing checksum without knowing the end of the firmware blob. A truncated record can therefore make those reads exceed the blob. The same record also supplies addresses and lengths for writes into DPRAM. The generic loader uses wrap-prone mixed signed arithmetic for its bounds check, while the application loader does not bound the staging copy at all. Pass the firmware end to the parser and validate the full source record. Use a signed wide offset for generic DPRAM records and validate the application staging span against the mapped DPRAM before copying.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/f6d9a6a9512430b39…
https://git.kernel.org/stable/c/84c850b08fc0d671c…
https://git.kernel.org/stable/c/d0eac0ea7cf493e78…
https://git.kernel.org/stable/c/ae588e5b9cc268de1…
https://git.kernel.org/stable/c/ad331e26fd213a19f…
https://git.kernel.org/stable/c/2ee477e541a6d5e43…
https://git.kernel.org/stable/c/808ed899dcf8bdef6…
https://git.kernel.org/stable/c/856d6cb04e5407523…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 03fd3cf5a179da12e6bee5e9d74b648aff68dc4c , < f6d9a6a9512430b395a1940d7b216394fd02d30b (git) Affected: 03fd3cf5a179da12e6bee5e9d74b648aff68dc4c , < 84c850b08fc0d671c245144b619683129b55690a (git) Affected: 03fd3cf5a179da12e6bee5e9d74b648aff68dc4c , < d0eac0ea7cf493e787fd7b4a556e43ef03cb4b50 (git) Affected: 03fd3cf5a179da12e6bee5e9d74b648aff68dc4c , < ae588e5b9cc268de1aabf30f939f0870717ca164 (git) Affected: 03fd3cf5a179da12e6bee5e9d74b648aff68dc4c , < ad331e26fd213a19fee0de18cdacd67b7ff5b478 (git) Affected: 03fd3cf5a179da12e6bee5e9d74b648aff68dc4c , < 2ee477e541a6d5e434d6a4041c6b677ab42e1d82 (git) Affected: 03fd3cf5a179da12e6bee5e9d74b648aff68dc4c , < 808ed899dcf8bdef66894fda5eb7ee4bb0eb8dc1 (git) Affected: 03fd3cf5a179da12e6bee5e9d74b648aff68dc4c , < 856d6cb04e5407523566b075841dcd6423757d1c (git)
Linux	Linux	Affected: 2.6.38 Unaffected: 0 , < 2.6.38 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/softing/softing_fw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f6d9a6a9512430b395a1940d7b216394fd02d30b",
              "status": "affected",
              "version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c",
              "versionType": "git"
            },
            {
              "lessThan": "84c850b08fc0d671c245144b619683129b55690a",
              "status": "affected",
              "version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c",
              "versionType": "git"
            },
            {
              "lessThan": "d0eac0ea7cf493e787fd7b4a556e43ef03cb4b50",
              "status": "affected",
              "version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c",
              "versionType": "git"
            },
            {
              "lessThan": "ae588e5b9cc268de1aabf30f939f0870717ca164",
              "status": "affected",
              "version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c",
              "versionType": "git"
            },
            {
              "lessThan": "ad331e26fd213a19fee0de18cdacd67b7ff5b478",
              "status": "affected",
              "version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c",
              "versionType": "git"
            },
            {
              "lessThan": "2ee477e541a6d5e434d6a4041c6b677ab42e1d82",
              "status": "affected",
              "version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c",
              "versionType": "git"
            },
            {
              "lessThan": "808ed899dcf8bdef66894fda5eb7ee4bb0eb8dc1",
              "status": "affected",
              "version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c",
              "versionType": "git"
            },
            {
              "lessThan": "856d6cb04e5407523566b075841dcd6423757d1c",
              "status": "affected",
              "version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/softing/softing_fw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.38"
            },
            {
              "lessThan": "2.6.38",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: softing: fw_parse(): validate firmware record spans\n\nfw_parse() reads a fixed record header, a firmware-provided payload,\nand a trailing checksum without knowing the end of the firmware blob. A\ntruncated record can therefore make those reads exceed the blob.\n\nThe same record also supplies addresses and lengths for writes into\nDPRAM. The generic loader uses wrap-prone mixed signed arithmetic for its\nbounds check, while the application loader does not bound the staging\ncopy at all.\n\nPass the firmware end to the parser and validate the full source record.\nUse a signed wide offset for generic DPRAM records and validate the\napplication staging span against the mapped DPRAM before copying."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Malformed firmware is consumed only via request_firmware() from the local firmware search path during softing_pdev_probe/softing_card_boot; CAN frames, network protocols, and bus traffic never reach fw_parse(), so exploitation requires local presence on the host loading the blob.\nAC:L - The attacker fully controls record type, addr, len, and payload in the Structured Binary Format file; a truncated final record or integer-wrapping addr/len values deterministically bypass the old bounds checks and trigger out-of-bounds reads/writes on every probe without races or layout luck.\nPR:L - fw_parse() performs no capability or credential checks, firmware paths under /lib/firmware/softing-4.6/ are writable by vendor/OTA accounts on many embedded and diagnostic deployments, and the sysfs firmware fallback loader exposes world-writable loading/data during request_firmware(), so a low-privileged local user can supply the malicious image.\nUI:N - Once the crafted blob is in place, parsing runs automatically from softing_card_boot during PCMCIA/platform probe on card insert or module bind; the attacker can trigger reload by reinserting the card or reloading softingcs themselves without requiring a separate victim action.\nS:U - The out-of-bounds reads and MMIO/DPRAM writes corrupt host kernel memory and the mapped Softing card region only; this is not a VM escape, IOMMU bypass, or other cross-security-authority breakout.\nC:H - fw_parse() reads record headers, variable-length payloads, and trailing checksums past the firmware buffer end, performing an out-of-bounds kernel read of adjacent vmalloc/kmalloc memory that can disclose sensitive kernel contents beyond a few bytes.\nI:H - Records supply addr and len used in memcpy_toio() into card DPRAM; the pre-fix mixed signed/unsigned bounds check could wrap and softing_load_app_fw staged copies without any DPRAM bound, enabling attacker-controlled out-of-bounds MMIO writes exploitable for memory corruption.\nA:H - Out-of-bounds MMIO writes past the ioremap window and out-of-bounds firmware-buffer reads readily fault on unmapped pages or corrupt critical DPRAM state, producing kernel oops/panic and denying use of the CAN interface on probe."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T06:22:23.266Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f6d9a6a9512430b395a1940d7b216394fd02d30b"
        },
        {
          "url": "https://git.kernel.org/stable/c/84c850b08fc0d671c245144b619683129b55690a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0eac0ea7cf493e787fd7b4a556e43ef03cb4b50"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae588e5b9cc268de1aabf30f939f0870717ca164"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad331e26fd213a19fee0de18cdacd67b7ff5b478"
        },
        {
          "url": "https://git.kernel.org/stable/c/2ee477e541a6d5e434d6a4041c6b677ab42e1d82"
        },
        {
          "url": "https://git.kernel.org/stable/c/808ed899dcf8bdef66894fda5eb7ee4bb0eb8dc1"
        },
        {
          "url": "https://git.kernel.org/stable/c/856d6cb04e5407523566b075841dcd6423757d1c"
        }
      ],
      "title": "can: softing: fw_parse(): validate firmware record spans",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80706",
    "datePublished": "2026-08-28T06:53:07.640Z",
    "dateReserved": "2026-08-26T14:34:25.787Z",
    "dateUpdated": "2026-08-29T06:22:23.266Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-Q4RV-GQHG-3PM9

CVE-2026-80706 (GCVE-0-2026-80706)

Tags

Sightings

Nomenclature