CVE-2026-5071: SocketCAN Out-of-Bounds Read Vulnerability – Local DoS & Memory Leak

Technical summary

CVE-2026-5071 is an out-of-bounds read vulnerability in the SocketCAN stack's frame processing logic. The zcan_sendto_ctx() function uses only a NET_ASSERT statement to validate the length of a user-supplied socketcan_frame buffer. In production configurations where assertions are disabled at compile time, this validation is eliminated. The socketcan_to_can_frame() function subsequently dereferences fields beyond the buffer boundary, reading uninitialized or adjacent kernel memory. Because the parsed frame is then transmitted on the network, adjacent memory contents can be leaked to other systems on the network segment. The vulnerability is classified as CWE-125 (Out-of-bounds Read).

Business impact

Organizations running production systems with SocketCAN networking face two immediate risks: availability loss from kernel crashes when malicious or malformed frames are processed, and confidentiality breaches if sensitive kernel memory is leaked over the network. In industrial IoT, automotive, or real-time systems relying on SocketCAN, an attacker with local access could craft frames that destabilize critical services or exfiltrate cryptographic material or session tokens from kernel memory. The memory leak vector is particularly concerning in multi-tenant or shared network environments where adjacent systems can passively observe transmitted frames.

Affected systems

SocketCAN is a network socket implementation for CAN (Controller Area Network) communication, commonly used in Linux kernels for automotive, industrial control, and embedded systems. The vulnerability affects systems running production kernel builds where NET_ASSERT macros are disabled. Embedded devices, real-time control systems, and automotive platforms using SocketCAN for in-vehicle or industrial network communication are in scope. The vulnerability requires local access (userspace application), limiting the attack surface to systems where untrusted code can execute locally or where a local account is compromised.

Exploitability

Exploitation requires local access to invoke the sendto() syscall with a crafted frame. The attack is straightforward: a local user supplies a buffer smaller than expected and manipulates the length parameter to cause the kernel to read beyond the allocated region. No special privileges are mandated by the vulnerability itself, though the impact (what memory can be reached) may vary with process context. The exploit is reliable and deterministic—the kernel will consistently dereference the truncated frame in the same way. The barrier to exploitation is low for an attacker with code execution on the target system.

Remediation

Apply a patch from your kernel or SocketCAN stack vendor that restores proper buffer length validation in production builds. The fix should replace the NET_ASSERT check with a persistent runtime validation that is not elided by compiler optimizations. Verify that the patched version enforces frame length bounds before socketcan_to_can_frame() processes the buffer. Consult your vendor's security advisory for the specific patched kernel or module version. As a temporary mitigation, restrict SocketCAN socket access using LSM policies or AppArmor/SELinux rules to limit which processes can open SocketCAN sockets, reducing the local attack surface.

Patch guidance

Contact your kernel distributor, automotive OEM, or embedded platform vendor for a patched kernel image or SocketCAN module update. The patch must address the removal of the NET_ASSERT dependency and implement unconditional buffer validation. When updating, verify that frame length checks remain active in both debug and production builds. Test the patch in a non-production environment on representative SocketCAN hardware to confirm that legitimate frame processing is not disrupted. Document the patch version applied for audit and compliance purposes.

Detection guidance

Monitor system logs for kernel crashes or panics originating from the SocketCAN stack (zcan or socketcan modules). Look for unexpected SIGABRT or kernel BUG messages in dmesg. If memory leak telemetry is available, observe for unusual packet payloads containing kernel pointers or sensitive data in network traffic from SocketCAN-enabled devices. At the application level, watch for processes attempting to send SocketCAN frames with truncated or malformed buffers. Implement network segmentation to isolate CAN bus interfaces and restrict SocketCAN socket creation to trusted applications only.

Why prioritize this

This vulnerability merits prompt attention due to its combination of local exploitability, direct denial-of-service impact, and memory leak consequences. The CVSS 6.1 MEDIUM score reflects the local-only attack vector and partial confidentiality impact, but organizations relying on SocketCAN for critical infrastructure or safety-critical systems should prioritize patching earlier. The production build bypass is a red flag—organizations running stripped-down or hardened kernels (common in embedded/automotive) are especially exposed because assertions are often disabled for performance. The fact that memory can leak over the network increases the blast radius in shared or monitored network segments.

Risk score, explained

The CVSS 3.1 score of 6.1 MEDIUM (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H) reflects: Attack Vector Local (AV:L) because the attacker must execute code or control a process on the target system; Attack Complexity Low (AC:L) because no special conditions or race conditions are needed; Privileges Required Low (PR:L) since any local user can invoke sendto(); User Interaction None (UI:N) because the attack is entirely programmatic; Scope Unchanged (S:U) because the impact is confined to the affected system; Confidentiality Low (C:L) due to memory leakage of adjacent kernel data; Integrity None (I:N) because the vulnerability does not allow writes; Availability High (A:H) because crashes reliably occur. Organizations with high availability requirements or safety-critical deployments may view the actual risk as elevated.

Frequently asked questions