CVE-2026-31570: can: gw: fix OOB heap access in cgw_csum_crc8_rel()
can: gw: fix OOB heap access in cgwcsumcrc8rel()
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel can-gw CRC8 cgw_csum_crc8_rel()to a version that resolves this vulnerability.Fixed in linux-7.0-rc2 - Configuration
Ensure the system has CAP_NET_ADMIN configured as needed for can-gw crc8 checksum functionality.
can-gw CRC8 checksums CAP_NET_ADMIN requirement = required - Configuration
Fix cgw_csum_crc8_rel() to use bounds-safe computed indices (from = calc_idx(...), to = calc_idx(...), res = calc_idx(...)) instead of raw from_idx/to_idx/result_idx (e.g., avoid using i = crc8->from_idx directly, which can be negative like -64).
cgw_csum_crc8_rel() index variables = use calc_idx() results
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31570?
CVE-2026-31570 is classified as a medium severity vulnerability due to its potential for out-of-bounds heap access.
How do I fix CVE-2026-31570?
To mitigate CVE-2026-31570, upgrade the Linux kernel to a version that does not contain this vulnerability.
Which Linux kernel versions are affected by CVE-2026-31570?
CVE-2026-31570 affects Linux kernel versions from 5.4.1 up to 6.19 and the 7.0-rc series.
What are the potential impacts of CVE-2026-31570?
Exploitation of CVE-2026-31570 could lead to arbitrary code execution or denial of service due to out-of-bounds memory access.
How can I determine if I am vulnerable to CVE-2026-31570?
You can check your Linux kernel version against the affected versions listed for CVE-2026-31570 to assess vulnerability.