CVE-2026-80706

The Linux kernel's 'can: softing' driver parses CAN interface firmware records with a parser (fw_parse) that reads a record header, payload, and trailing checksum without knowing the end of the firmware blob, so a truncated or malformed firmware record can cause reads past the end of the blob. The same record also drives writes into the card's DPRAM, where the generic loader's bounds check uses wrap-prone mixed signed arithmetic and the application loader does not bound its staging copy at all, allowing writes beyond the mapped DPRAM. A local attacker or user able to supply a corrupted or truncated firmware blob to the softing driver could trigger out-of-bounds reads and writes in kernel space, potentially leading to memory disclosure, kernel memory corruption, or privilege escalation (CVSS 7.8, local vector). Only systems using Softing CAN interface hardware with the softing driver and its firmware-loading path are affected. There are no known public exploits, the flaw is not in CISA KEV, and EPSS estimates only a 0.1% chance of exploitation in the next 30 days.

What to do: Apply kernel updates that include the resolved patch for the softing firmware parser (no specific fixed version is stated in this data; track your distribution's kernel advisory for the backported fix). Ensure the Softing firmware files on affected systems are the intact, vendor-provided originals, since truncated or user-modified blobs trigger the flaw; systems without Softing CAN hardware are not exposed.