Out-of-Bounds Read Vulnerability in SocketCAN Implementation by Zephyr Project

CVE-2026-5071

What is CVE-2026-5071?

The SocketCAN implementation in the Zephyr Project is susceptible to an out-of-bounds read due to improper validation of user-provided buffer lengths. In the zcan_sendto_ctx() function, the length of the socketcan_frame object is validated using a NET_ASSERT statement, which is ineffective in production builds where assertions are disabled. This allows a userspace application to control the length parameter passed to a sendto syscall, potentially submitting a truncated frame. As a result, when the socketcan_to_can_frame() function dereferences this incomplete frame, it may access memory beyond the buffer's end. This could lead to denial-of-service crashes or leak sensitive adjacent memory contents transmitted over the network.

References