Executive brief
The Softing CAN controller driver in the Linux kernel contains a vulnerability in its firmware loading code that fails to validate record boundaries, allowing out-of-bounds memory reads and writes. An attacker with ability to provide malicious firmware could trigger memory disclosure, denial of service, or potentially execute code on systems using affected Softing CAN adapters.
Technical details
The vulnerability is a buffer over-read (CWE-125) in the fw_parse() function within drivers/net/can/softing/softing_fw.c. The firmware loader reads a fixed 8-byte record header plus a payload of variable length and a 2-byte checksum without validating that the entire record (including checksum) fits within the firmware blob boundaries. For generic DPRAM writes, mixed signed/unsigned arithmetic in bounds checking can wrap around; for application loader staging, no bounds check exists at all. An attacker providing a truncated or specially crafted firmware blob can trigger out-of-bounds reads via le16_to_cpup() and le32_to_cpup() calls, or out-of-bounds writes via memcpy() into kernel buffers. The fix validates the full record span against firmware end before parsing, uses signed-wide offsets for arithmetic, and enforces bounds on staging copies.
Affected products
- Linux Linux kernel Multiple versions; patch available in stable series
Timeline
- 2026-08-28: disclosed
- 2026-08-09: patched: Patch merged into stable kernel series