CVE-2026-80706

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-80706", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.787Z", "datePublished": "2026-08-28T06:53:07.640Z", "dateUpdated": "2026-10-16T19:26:34.192Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-29T06:22:23.266Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: softing: fw_parse(): validate firmware record spans\n\nfw_parse() reads a fixed record header, a firmware-provided payload,\nand a trailing checksum without knowing the end of the firmware blob. A\ntruncated record can therefore make those reads exceed the blob.\n\nThe same record also supplies addresses and lengths for writes into\nDPRAM. The generic loader uses wrap-prone mixed signed arithmetic for its\nbounds check, while the application loader does not bound the staging\ncopy at all.\n\nPass the firmware end to the parser and validate the full source record.\nUse a signed wide offset for generic DPRAM records and validate the\napplication staging span against the mapped DPRAM before copying."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Malformed firmware is consumed only via request_firmware() from the local firmware search path during softing_pdev_probe/softing_card_boot; CAN frames, network protocols, and bus traffic never reach fw_parse(), so exploitation requires local presence on the host loading the blob.\nAC:L - The attacker fully controls record type, addr, len, and payload in the Structured Binary Format file; a truncated final record or integer-wrapping addr/len values deterministically bypass the old bounds checks and trigger out-of-bounds reads/writes on every probe without races or layout luck.\nPR:L - fw_parse() performs no capability or credential checks, firmware paths under /lib/firmware/softing-4.6/ are writable by vendor/OTA accounts on many embedded and diagnostic deployments, and the sysfs firmware fallback loader exposes world-writable loading/data during request_firmware(), so a low-privileged local user can supply the malicious image.\nUI:N - Once the crafted blob is in place, parsing runs automatically from softing_card_boot during PCMCIA/platform probe on card insert or module bind; the attacker can trigger reload by reinserting the card or reloading softingcs themselves without requiring a separate victim action.\nS:U - The out-of-bounds reads and MMIO/DPRAM writes corrupt host kernel memory and the mapped Softing card region only; this is not a VM escape, IOMMU bypass, or other cross-security-authority breakout.\nC:H - fw_parse() reads record headers, variable-length payloads, and trailing checksums past the firmware buffer end, performing an out-of-bounds kernel read of adjacent vmalloc/kmalloc memory that can disclose sensitive kernel contents beyond a few bytes.\nI:H - Records supply addr and len used in memcpy_toio() into card DPRAM; the pre-fix mixed signed/unsigned bounds check could wrap and softing_load_app_fw staged copies without any DPRAM bound, enabling attacker-controlled out-of-bounds MMIO writes exploitable for memory corruption.\nA:H - Out-of-bounds MMIO writes past the ioremap window and out-of-bounds firmware-buffer reads readily fault on unmapped pages or corrupt critical DPRAM state, producing kernel oops/panic and denying use of the CAN interface on probe."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/can/softing/softing_fw.c"], "versions": [{"version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c", "lessThan": "f6d9a6a9512430b395a1940d7b216394fd02d30b", "status": "affected", "versionType": "git"}, {"version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c", "lessThan": "84c850b08fc0d671c245144b619683129b55690a", "status": "affected", "versionType": "git"}, {"version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c", "lessThan": "d0eac0ea7cf493e787fd7b4a556e43ef03cb4b50", "status": "affected", "versionType": "git"}, {"version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c", "lessThan": "ae588e5b9cc268de1aabf30f939f0870717ca164", "status": "affected", "versionType": "git"}, {"version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c", "lessThan": "ad331e26fd213a19fee0de18cdacd67b7ff5b478", "status": "affected", "versionType": "git"}, {"version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c", "lessThan": "2ee477e541a6d5e434d6a4041c6b677ab42e1d82", "status": "affected", "versionType": "git"}, {"version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c", "lessThan": "808ed899dcf8bdef66894fda5eb7ee4bb0eb8dc1", "status": "affected", "versionType": "git"}, {"version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c", "lessThan": "856d6cb04e5407523566b075841dcd6423757d1c", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/can/softing/softing_fw.c"], "versions": [{"version": "2.6.38", "status": "affected"}, {"version": "0", "lessThan": "2.6.38", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.265", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.151", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.103", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.44", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.8", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "5.10.265"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "5.15.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "6.6.151"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "6.12.103"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "6.18.44"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "7.1.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f6d9a6a9512430b395a1940d7b216394fd02d30b"}, {"url": "https://git.kernel.org/stable/c/84c850b08fc0d671c245144b619683129b55690a"}, {"url": "https://git.kernel.org/stable/c/d0eac0ea7cf493e787fd7b4a556e43ef03cb4b50"}, {"url": "https://git.kernel.org/stable/c/ae588e5b9cc268de1aabf30f939f0870717ca164"}, {"url": "https://git.kernel.org/stable/c/ad331e26fd213a19fee0de18cdacd67b7ff5b478"}, {"url": "https://git.kernel.org/stable/c/2ee477e541a6d5e434d6a4041c6b677ab42e1d82"}, {"url": "https://git.kernel.org/stable/c/808ed899dcf8bdef66894fda5eb7ee4bb0eb8dc1"}, {"url": "https://git.kernel.org/stable/c/856d6cb04e5407523566b075841dcd6423757d1c"}], "title": "can: softing: fw_parse(): validate firmware record spans", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-80706", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:20:24.155772Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:26:34.192Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-80706", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:20:24.155772Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:20:25.284Z"}}], "cna": {"title": "can: softing: fw_parse(): validate firmware record spans", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - Malformed firmware is consumed only via request_firmware() from the local firmware search path during softing_pdev_probe/softing_card_boot; CAN frames, network protocols, and bus traffic never reach fw_parse(), so exploitation requires local presence on the host loading the blob.\nAC:L - The attacker fully controls record type, addr, len, and payload in the Structured Binary Format file; a truncated final record or integer-wrapping addr/len values deterministically bypass the old bounds checks and trigger out-of-bounds reads/writes on every probe without races or layout luck.\nPR:L - fw_parse() performs no capability or credential checks, firmware paths under /lib/firmware/softing-4.6/ are writable by vendor/OTA accounts on many embedded and diagnostic deployments, and the sysfs firmware fallback loader exposes world-writable loading/data during request_firmware(), so a low-privileged local user can supply the malicious image.\nUI:N - Once the crafted blob is in place, parsing runs automatically from softing_card_boot during PCMCIA/platform probe on card insert or module bind; the attacker can trigger reload by reinserting the card or reloading softingcs themselves without requiring a separate victim action.\nS:U - The out-of-bounds reads and MMIO/DPRAM writes corrupt host kernel memory and the mapped Softing card region only; this is not a VM escape, IOMMU bypass, or other cross-security-authority breakout.\nC:H - fw_parse() reads record headers, variable-length payloads, and trailing checksums past the firmware buffer end, performing an out-of-bounds kernel read of adjacent vmalloc/kmalloc memory that can disclose sensitive kernel contents beyond a few bytes.\nI:H - Records supply addr and len used in memcpy_toio() into card DPRAM; the pre-fix mixed signed/unsigned bounds check could wrap and softing_load_app_fw staged copies without any DPRAM bound, enabling attacker-controlled out-of-bounds MMIO writes exploitable for memory corruption.\nA:H - Out-of-bounds MMIO writes past the ioremap window and out-of-bounds firmware-buffer reads readily fault on unmapped pages or corrupt critical DPRAM state, producing kernel oops/panic and denying use of the CAN interface on probe."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c", "lessThan": "f6d9a6a9512430b395a1940d7b216394fd02d30b", "versionType": "git"}, {"status": "affected", "version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c", "lessThan": "84c850b08fc0d671c245144b619683129b55690a", "versionType": "git"}, {"status": "affected", "version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c", "lessThan": "d0eac0ea7cf493e787fd7b4a556e43ef03cb4b50", "versionType": "git"}, {"status": "affected", "version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c", "lessThan": "ae588e5b9cc268de1aabf30f939f0870717ca164", "versionType": "git"}, {"status": "affected", "version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c", "lessThan": "ad331e26fd213a19fee0de18cdacd67b7ff5b478", "versionType": "git"}, {"status": "affected", "version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c", "lessThan": "2ee477e541a6d5e434d6a4041c6b677ab42e1d82", "versionType": "git"}, {"status": "affected", "version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c", "lessThan": "808ed899dcf8bdef66894fda5eb7ee4bb0eb8dc1", "versionType": "git"}, {"status": "affected", "version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c", "lessThan": "856d6cb04e5407523566b075841dcd6423757d1c", "versionType": "git"}], "programFiles": ["drivers/net/can/softing/softing_fw.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.38"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.38", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.265", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.216", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.183", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.151", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.103", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.44", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.8", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/can/softing/softing_fw.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/f6d9a6a9512430b395a1940d7b216394fd02d30b"}, {"url": "https://git.kernel.org/stable/c/84c850b08fc0d671c245144b619683129b55690a"}, {"url": "https://git.kernel.org/stable/c/d0eac0ea7cf493e787fd7b4a556e43ef03cb4b50"}, {"url": "https://git.kernel.org/stable/c/ae588e5b9cc268de1aabf30f939f0870717ca164"}, {"url": "https://git.kernel.org/stable/c/ad331e26fd213a19fee0de18cdacd67b7ff5b478"}, {"url": "https://git.kernel.org/stable/c/2ee477e541a6d5e434d6a4041c6b677ab42e1d82"}, {"url": "https://git.kernel.org/stable/c/808ed899dcf8bdef66894fda5eb7ee4bb0eb8dc1"}, {"url": "https://git.kernel.org/stable/c/856d6cb04e5407523566b075841dcd6423757d1c"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: softing: fw_parse(): validate firmware record spans\n\nfw_parse() reads a fixed record header, a firmware-provided payload,\nand a trailing checksum without knowing the end of the firmware blob. A\ntruncated record can therefore make those reads exceed the blob.\n\nThe same record also supplies addresses and lengths for writes into\nDPRAM. The generic loader uses wrap-prone mixed signed arithmetic for its\nbounds check, while the application loader does not bound the staging\ncopy at all.\n\nPass the firmware end to the parser and validate the full source record.\nUse a signed wide offset for generic DPRAM records and validate the\napplication staging span against the mapped DPRAM before copying."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.265", "versionStartIncluding": "2.6.38"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.216", "versionStartIncluding": "2.6.38"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.183", "versionStartIncluding": "2.6.38"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.151", "versionStartIncluding": "2.6.38"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.103", "versionStartIncluding": "2.6.38"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.44", "versionStartIncluding": "2.6.38"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.8", "versionStartIncluding": "2.6.38"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "2.6.38"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-29T06:22:23.266Z"}}}, "cveMetadata": {"cveId": "CVE-2026-80706", "state": "PUBLISHED", "dateUpdated": "2026-10-16T19:26:34.192Z", "dateReserved": "2026-08-26T14:34:25.787Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-28T06:53:07.640Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/can/softing/softing_fw.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "f6d9a6a9512430b395a1940d7b216394fd02d30b", "status": "affected", "version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c", "versionType": "git"}, {"lessThan": "84c850b08fc0d671c245144b619683129b55690a", "status": "affected", "version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c", "versionType": "git"}, {"lessThan": "d0eac0ea7cf493e787fd7b4a556e43ef03cb4b50", "status": "affected", "version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c", "versionType": "git"}, {"lessThan": "ae588e5b9cc268de1aabf30f939f0870717ca164", "status": "affected", "version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c", "versionType": "git"}, {"lessThan": "ad331e26fd213a19fee0de18cdacd67b7ff5b478", "status": "affected", "version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c", "versionType": "git"}, {"lessThan": "2ee477e541a6d5e434d6a4041c6b677ab42e1d82", "status": "affected", "version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c", "versionType": "git"}, {"lessThan": "808ed899dcf8bdef66894fda5eb7ee4bb0eb8dc1", "status": "affected", "version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c", "versionType": "git"}, {"lessThan": "856d6cb04e5407523566b075841dcd6423757d1c", "status": "affected", "version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/can/softing/softing_fw.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.38"}, {"lessThan": "2.6.38", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.265", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.216", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.151", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.103", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.44", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: softing: fw_parse(): validate firmware record spans\n\nfw_parse() reads a fixed record header, a firmware-provided payload,\nand a trailing checksum without knowing the end of the firmware blob. A\ntruncated record can therefore make those reads exceed the blob.\n\nThe same record also supplies addresses and lengths for writes into\nDPRAM. The generic loader uses wrap-prone mixed signed arithmetic for its\nbounds check, while the application loader does not bound the staging\ncopy at all.\n\nPass the firmware end to the parser and validate the full source record.\nUse a signed wide offset for generic DPRAM records and validate the\napplication staging span against the mapped DPRAM before copying."}], "id": "CVE-2026-80706", "lastModified": "2026-10-16T20:18:07.340", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-80706", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T19:20:24.155772Z", "version": "2.0.3"}}]}, "published": "2026-08-28T08:16:56.150", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2ee477e541a6d5e434d6a4041c6b677ab42e1d82"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/808ed899dcf8bdef66894fda5eb7ee4bb0eb8dc1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/84c850b08fc0d671c245144b619683129b55690a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/856d6cb04e5407523566b075841dcd6423757d1c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ad331e26fd213a19fee0de18cdacd67b7ff5b478"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ae588e5b9cc268de1aabf30f939f0870717ca164"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d0eac0ea7cf493e787fd7b4a556e43ef03cb4b50"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f6d9a6a9512430b395a1940d7b216394fd02d30b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: can: softing: fw_parse(): validate firmware record spans", "id": "2525420", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2525420"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ncan: softing: fw_parse(): validate firmware record spans\nfw_parse() reads a fixed record header, a firmware-provided payload,\nand a trailing checksum without knowing the end of the firmware blob. A\ntruncated record can therefore make those reads exceed the blob.\nThe same record also supplies addresses and lengths for writes into\nDPRAM. The generic loader uses wrap-prone mixed signed arithmetic for its\nbounds check, while the application loader does not bound the staging\ncopy at all.\nPass the firmware end to the parser and validate the full source record.\nUse a signed wide offset for generic DPRAM records and validate the\napplication staging span against the mapped DPRAM before copying.", "A flaw was found in the `softing` module of the Linux kernel. This vulnerability exists within the `fw_parse()` function, which handles firmware records. It fails to properly validate the size of these records against the firmware data, leading to situations where the system can read or write data beyond its intended memory boundaries. This out-of-bounds access could allow an attacker to disclose sensitive information or execute unauthorized code on the system."], "name": "CVE-2026-80706", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-80706\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-80706\nhttps://lore.kernel.org/linux-cve-announce/2026082807-CVE-2026-80706-9c56@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[03fd3cf5a179da12e6bee5e9d74b648aff68dc4c,f6d9a6a9512430b395a1940d7b216394fd02d30b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[03fd3cf5a179da12e6bee5e9d74b648aff68dc4c,84c850b08fc0d671c245144b619683129b55690a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[03fd3cf5a179da12e6bee5e9d74b648aff68dc4c,d0eac0ea7cf493e787fd7b4a556e43ef03cb4b50)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[03fd3cf5a179da12e6bee5e9d74b648aff68dc4c,ae588e5b9cc268de1aabf30f939f0870717ca164)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[03fd3cf5a179da12e6bee5e9d74b648aff68dc4c,ad331e26fd213a19fee0de18cdacd67b7ff5b478)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[03fd3cf5a179da12e6bee5e9d74b648aff68dc4c,2ee477e541a6d5e434d6a4041c6b677ab42e1d82)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[03fd3cf5a179da12e6bee5e9d74b648aff68dc4c,808ed899dcf8bdef66894fda5eb7ee4bb0eb8dc1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[03fd3cf5a179da12e6bee5e9d74b648aff68dc4c,856d6cb04e5407523566b075841dcd6423757d1c)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.38"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.38)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.265,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.216,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.183,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.151,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.103,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.44,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.8,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-28T11:30:06.782468+00:00", "updated": "2026-08-29T10:45:05.011476+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-787"]}