Description

In the Linux kernel, the following vulnerability has been resolved: can: softing: fw_parse(): validate firmware record spans fw_parse() reads a fixed record header, a firmware-provided payload, and a trailing checksum without knowing the end of the firmware blob. A truncated record can therefore make those reads exceed the blob. The same record also supplies addresses and lengths for writes into DPRAM. The generic loader uses wrap-prone mixed signed arithmetic for its bounds check, while the application loader does not bound the staging copy at all. Pass the firmware end to the parser and validate the full source record. Use a signed wide offset for generic DPRAM records and validate the application staging span against the mapped DPRAM before copying.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-28T08:16:56.150Z",
  "pubdate": "2026-08-28T08:16:56.150Z",
  "executiveSummary": "The Linux kernel's Softing CAN driver contains a critical out-of-bounds access vulnerability during firmware record parsing within the fw_parse() function.\nThe vulnerability arises from insufficient validation of firmware record lengths, leading to potential memory corruption or information disclosure.\nAn attacker capable of supplying a malicious firmware blob can trigger out-of-bounds reads or writes when the driver processes truncated or malformed records.\nThe flaw affects the interaction between the firmware provided payload and the device's DPRAM (Dual-Port RAM).\nExploitation requires the ability to provide a crafted firmware file, which may be achievable if an attacker has administrative privileges to load firmware onto the kernel-managed device.\nThe impact includes potential privilege escalation, system instability (kernel panic), or arbitrary memory writes within the DPRAM scope.",
  "technicalDetails": "The vulnerability is located in the fw_parse() function within the Softing CAN driver. The function parses firmware binary blobs without maintaining or validating a boundary against the end of the input buffer.\nThe root cause is two-fold: missing boundary checks for input records and dangerous arithmetic during memory access. Specifically, the parser reads a fixed-size header, a variable-length payload, and a checksum without verifying that these segments reside within the allocated firmware blob memory. Consequently, a truncated record results in the parser attempting to read data past the end of the buffer.\nFurthermore, the driver performs write operations into DPRAM based on offsets and lengths provided directly within the firmware record. The generic loader utilizes signed integer arithmetic for its bounds checks, which is prone to integer overflow/wrap-around vulnerabilities. The application loader completely omits bounds checking when staging copies, creating a direct path for buffer overflows.\nAttack flow: 1. The attacker provides a crafted firmware image to the Softing CAN interface. 2. The driver invokes fw_parse() to process the binary content. 3. The attacker provides a malformed record with an oversized length field or an offset that, when added to the base address, points outside the valid DPRAM bounds or the source buffer. 4. Due to the lack of validation, the driver performs an out-of-bounds read from the kernel memory space or an out-of-bounds write into the DPRAM region.\nThe lack of proper span validation means that the loader does not confirm if the provided length fits within the physical mapping of the DPRAM before executing memory copy operations. This allows an attacker to overwrite sensitive device control structures or memory addresses, leading to remote code execution on the device or local privilege escalation on the host system."
}