|
Vulnerabilities
< Back

CVE-2026-31570

Updated on 24 Apr 2026

Severity

8.8 High severity

Details

CVSS score
8.8
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

can: gw: fix OOB heap access in cgw_csum_crc8_rel()

cgw_csum_crc8_rel() correctly computes bounds-safe indices via calc_idx():

int from = calc_idx(crc8->from_idx, cf->len); int to = calc_idx(crc8->to_idx, cf->len); int res = calc_idx(crc8->result_idx, cf->len);

if (from < 0 || to < 0 || res < 0) return;

However, the loop and the result write then use the raw s8 fields directly instead of the computed variables:

for (i = crc8->from_idx; …) /* BUG: raw negative index / cf->data[crc8->result_idx] = …; / BUG: raw negative index */

With from_idx = to_idx = result_idx = -64 on a 64-byte CAN FD frame, calc_idx(-64, 64) = 0 so the guard passes, but the loop iterates with i = -64, reading cf->data[-64], and the write goes to cf->data[-64]. This write might end up to 56 (7.0-rc) or 40 (<= 6.19) bytes before the start of the canfd_frame on the heap.

The companion function cgw_csum_xor_rel() uses from/to/res correctly throughout; fix cgw_csum_crc8_rel() to match.

Confirmed with KASAN on linux-7.0-rc2: BUG: KASAN: slab-out-of-bounds in cgw_csum_crc8_rel+0x515/0x5b0 Read of size 1 at addr ffff8880076619c8 by task poc_cgw_oob/62

To configure the can-gw crc8 checksums CAP_NET_ADMIN is needed.

Details

Affected product:
Ubuntu 20.04 ELS
Affected packages:
linux-meta @ 5.4.0

Fixes

KernelCare state

Live-patch status from KernelCare for each operating system.

Operating system Status Covered kernels
Amazon Linux 2023 Planned —
Debian 11 Released
37 kernels
  • 5.10.46-5
  • 5.10.70-1
  • 5.10.46-4
  • 5.10.84-1
  • 5.10.92-1
  • 5.10.92-2
  • 5.10.103-1
  • 5.10.106-1
  • 5.10.113-1
  • 5.10.120-1
  • 5.10.127-1
  • 5.10.127-2
  • 5.10.136-1
  • 5.10.140-1
  • 5.10.149-1
  • 5.10.149-2
  • 5.10.158-2
  • 5.10.162-1
  • 5.10.179-1
  • 5.10.179-2
  • 5.10.179-3
  • 5.10.179-5
  • 5.10.191-1
  • 5.10.197-1
  • 5.10.178-3
  • 5.10.205-2
  • 5.10.205-1
  • 5.10.209-2
  • 5.10.216-1
  • 5.10.218-1
  • 5.10.221-1
  • 5.10.223-1
  • 5.10.226-1
  • 5.10.234-1
  • 5.10.237-1
  • 5.10.244-1
  • 5.10.247-1
Debian 11 cloud Released
17 kernels
  • 5.10.113-1
  • 5.10.179-2
  • 5.10.179-3
  • 5.10.179-5
  • 5.10.191-1
  • 5.10.197-1
  • 5.10.205-2
  • 5.10.209-2
  • 5.10.216-1
  • 5.10.218-1
  • 5.10.221-1
  • 5.10.223-1
  • 5.10.226-1
  • 5.10.234-1
  • 5.10.237-1
  • 5.10.244-1
  • 5.10.247-1
Debian 12 Released
35 kernels
  • 6.1.38-1
  • 6.1.38-2
  • 6.1.38-4
  • 6.1.52-1
  • 6.1.55-1
  • 6.1.64-1
  • 6.1.66-1
  • 6.1.69-1
  • 6.1.76-1
  • 6.1.27-1
  • 6.1.67-1
  • 6.1.85-1
  • 6.1.90-1
  • 6.1.94-1
  • 6.1.99-1
  • 6.1.106-3
  • 6.1.112-1
  • 6.1.115-1
  • 6.1.119-1
  • 6.1.123-1
  • 6.1.128-1
  • 6.1.124-1
  • 6.1.129-1
  • 6.1.133-1
  • 6.1.135-1
  • 6.1.137-1
  • 6.1.140-1
  • 6.1.139-1
  • 6.1.147-1
  • 6.1.148-1
  • 6.1.153-1
  • 6.1.158-1
  • 6.1.159-1
  • 6.1.162-1
  • 6.1.164-1
Debian 13 Planned —
Ubuntu 22.04 Planned —
Ubuntu 24.04 Planned —