EUVD-2026-67441
GHSA-q4rv-gqhg-3pm9
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local attack vector confirmed by driver-level firmware loading; PR:L required for device/module access; unchecked DPRAM writes yield full kernel memory control justifying H/H/H.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
can: softing: fw_parse(): validate firmware record spans
fw_parse() reads a fixed record header, a firmware-provided payload, and a trailing checksum without knowing the end of the firmware blob. A truncated record can therefore make those reads exceed the blob.
The same record also supplies addresses and lengths for writes into DPRAM. The generic loader uses wrap-prone mixed signed arithmetic for its bounds check, while the application loader does not bound the staging copy at all.
Pass the firmware end to the parser and validate the full source record. Use a signed wide offset for generic DPRAM records and validate the application staging span against the mapped DPRAM before copying.
AnalysisAI
Out-of-bounds read and write vulnerabilities in the Linux kernel's softing CAN driver fw_parse() function allow a local low-privileged attacker to corrupt kernel DPRAM memory by supplying a crafted firmware image. Affected kernels span from 2.6.38 through pre-patch stable branches (5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, 7.1.x, and 7.2), with fixes backported across all active stable trees. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local interactive access with at least low-privilege credentials (PR:L per CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) accurately reflects the worst-case local exploitation scenario: a low-privileged user on an affected system can achieve kernel memory corruption with full CIA impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Linux kernel to a patched stable release: 5.10.265, 5.15.216, 6.1.183, 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2 or later, as confirmed by EUVD. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux systems running kernel versions 2.6.38 through 7.2.x, with particular focus on 5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, 7.1.x, and 7.2 branches to identify those with the softing CAN driver enabled. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today