CVE-2026-80706

What it actually does

Missing bounds validation in fw_parse() allows reads past the end of a supplied firmware blob and uncontrolled writes into DPRAM using wrap-prone arithmetic, resulting in kernel memory corruption.

Why it matters to the business

Local users on affected Linux systems can crash the kernel or execute arbitrary code, leading to denial of service or full host compromise on machines using the softing CAN driver.

How an attack unfolds

An attacker supplies a truncated or malformed firmware image to the softing CAN driver; the parser reads beyond the blob and performs unbounded DPRAM writes, corrupting kernel memory and allowing code execution or system crash.

How to fix it

Apply the upstream fix that passes the firmware end pointer to the parser, uses a wide signed offset for DPRAM bounds, and validates both source records and staging copies before any write.

How to confirm the fix worked

Confirm the patched kernel contains the commit that adds firmware-end validation and signed wide offsets; recompile the softing driver and test with deliberately truncated firmware images to ensure no out-of-bounds access occurs.

Typical attack path

1. Obtain local access on a system exposing the softing CAN driver
2. Craft a firmware blob with an undersized record header or payload
3. Load the blob via the driver's firmware interface
4. Trigger out-of-bounds reads and wrap-prone DPRAM address calculations
5. Achieve kernel memory corruption leading to privilege escalation or DoS

How to detect it

Review kernel logs for softing driver oops or firmware load errors; look for unusual DPRAM access patterns or crashes originating from the can/softing module after firmware upload attempts.

What your security team should do

• Prioritize kernel updates on any host that loads softing CAN firmware
• Restrict local access to systems with the driver enabled until patched
• Monitor for future CVEs in CAN firmware parsers and enable kernel hardening options such as KASAN during testing