{"id":"CVE-2026-31570","revision":"2d3f324c67624a7eb2a519cfb9d01485","records":[{"revision":"2d3f324c67624a7eb2a519cfb9d01485","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-31570","aliases":[],"title":"can: gw: fix OOB heap access in cgw_csum_crc8_rel()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncan: gw: fix OOB heap access in cgw_csum_crc8_rel()\n\ncgw_csum_crc8_rel() correctly computes bounds-safe indices via calc_idx():\n\n    int from = calc_idx(crc8->from_idx, cf->len);\n    int to   = calc_idx(crc8->to_idx,   cf->len);\n    int res  = calc_idx(crc8->result_idx, cf->len);\n\n    if (from < 0 || to < 0 || res < 0)\n        return;\n\nHowever, the loop and the result write then use the raw s8 fields directly\ninstead of the computed variables:\n\n    for (i = crc8->from_idx; ...)        /* BUG: raw negative index */\n    cf->data[crc8->result_idx] = ...;    /* BUG: raw negative index */\n\nWith from_idx = to_idx = result_idx = -64 on a 64-byte CAN FD frame,\ncalc_idx(-64, 64) = 0 so the guard passes, but the loop iterates with\ni = -64, reading cf->data[-64], and the write goes to cf->data[-64].\nThis write might end up to 56 (7.0-rc) or 40 (<= 6.19) bytes before the\nstart of the canfd_frame on the heap.\n\nThe companion function cgw_csum_xor_rel() uses `from`/`to`/`res`\ncorrectly throughout; fix cgw_csum_crc8_rel() to match.\n\nConfirmed with KASAN on linux-7.0-rc2:\n  BUG: KASAN: slab-out-of-bounds in cgw_csum_crc8_rel+0x515/0x5b0\n  Read of size 1 at addr ffff8880076619c8 by task poc_cgw_oob/62\n\nTo configure the can-gw crc8 checksums CAP_NET_ADMIN is needed.","state":0,"publishedAt":"2026-04-24T14:35:49.435+00:00","modifiedAt":"2026-10-19T18:55:59.285+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/can/gw.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"456a8a646b2563438c16a9b27decf9aa717f1ebb\",\n                            \"lessThan\": \"e7c99348b0612b2bc02d5ce6ff9873261cc7605f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"456a8a646b2563438c16a9b27decf9aa717f1ebb\",\n                            \"lessThan\": \"999ca48d55a8a46da21519db7e834e5867200379\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"456a8a646b2563438c16a9b27decf9aa717f1ebb\",\n                            \"lessThan\": \"a025283d7f7404c739225e457fb99db2368bb544\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"456a8a646b2563438c16a9b27decf9aa717f1ebb\",\n                            \"lessThan\": \"54ecdf76a55e75c1f5085e440f8ab671a3283ef5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"456a8a646b2563438c16a9b27decf9aa717f1ebb\",\n                            \"lessThan\": \"c4e8eaa75fa0b6bcbfa5356d6195c4ad0e05e57a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"456a8a646b2563438c16a9b27decf9aa717f1ebb\",\n                            \"lessThan\": \"84f8b76d24273175a22713e83e90874e1880d801\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"456a8a646b2563438c16a9b27decf9aa717f1ebb\",\n                            \"lessThan\": \"66b689efd08227da2c5ca49b58b30a95d23c695a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"456a8a646b2563438c16a9b27decf9aa717f1ebb\",\n                            \"lessThan\": \"b9c310d72783cc2f30d103eed83920a5a29c671a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/can/gw.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.4\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.4\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.253\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.203\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.168\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.131\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.80\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.21\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.19.11\",\n                            \"lessThanOrEqual\": \"6.19.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/e7c99348b0612b2bc02d5ce6ff9873261cc7605f","https://git.kernel.org/stable/c/999ca48d55a8a46da21519db7e834e5867200379","https://git.kernel.org/stable/c/a025283d7f7404c739225e457fb99db2368bb544","https://git.kernel.org/stable/c/54ecdf76a55e75c1f5085e440f8ab671a3283ef5","https://git.kernel.org/stable/c/c4e8eaa75fa0b6bcbfa5356d6195c4ad0e05e57a","https://git.kernel.org/stable/c/84f8b76d24273175a22713e83e90874e1880d801","https://git.kernel.org/stable/c/66b689efd08227da2c5ca49b58b30a95d23c695a","https://git.kernel.org/stable/c/b9c310d72783cc2f30d103eed83920a5a29c671a"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-31570","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-31570","identifiers":["CVE-2026-31570"]},"retained":false,"historicalAffected":[]}],"coverage":[]}