CVE-2026-80707

The Linux kernel's SAE J1939 (CAN bus) transport implementation failed to zero the receive buffer allocated in j1939_session_fresh_new(), so buffers could be delivered containing residual, uninitialized kernel heap data. The flaw is triggered when a J1939 transport/ETP session allocates a buffer that is not fully written before being handed to the receiver, letting stale kernel memory be exposed to a process using AF_CAN/J1939 sockets or to a peer able to reach the CAN endpoint, consistent with the assigned network-vector CVSS. The impact is confidentiality only (CVSS 3.1 score 7.5, C:H/I:N/A:N): an attacker can potentially read fragments of kernel memory, with no corruption or crash of the system. Only systems running Linux kernels with CAN J1939 support enabled and actually in use are affected, which typically means automotive, agricultural, marine and industrial gateways and telematics devices rather than ordinary servers or desktops. No public proof-of-concept is known, the flaw is not in CISA's KEV catalog, and EPSS estimates only about a 0.3% chance of exploitation within 30 days.

What to do: Install a kernel update from your distribution that includes the upstream fix for CVE-2026-80707 (the patch zeroes the allocated session buffer); do not rely on unpatched kernels on devices that expose J1939. First check whether CONFIG_CAN_J1939 is enabled and whether any process actually uses AF_CAN/J1939 sockets - if not, the system is not affected and no urgent action is needed. As an interim mitigation, restrict untrusted local users' access to J1939 sockets and avoid exposing CAN endpoints to untrusted networks.