{"id":"CVE-2026-31570","title":"can: gw: fix OOB heap access in cgw_csum_crc8_rel()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ncan: gw: fix OOB heap access in cgw_csum_crc8_rel()\n\ncgw_csum_crc8_rel() correctly computes bounds-safe indices via calc_idx():\n\n    int from = calc_idx(crc8->from_idx,…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 456a8a646b2563438c16a9b27decf9aa717f1ebb < e7c99348b0612b2bc02d5ce6ff9873261cc7605f","Linux >= 456a8a646b2563438c16a9b27decf9aa717f1ebb < 999ca48d55a8a46da21519db7e834e5867200379","Linux >= 456a8a646b2563438c16a9b27decf9aa717f1ebb < a025283d7f7404c739225e457fb99db2368bb544","Linux >= 456a8a646b2563438c16a9b27decf9aa717f1ebb < 54ecdf76a55e75c1f5085e440f8ab671a3283ef5","Linux >= 456a8a646b2563438c16a9b27decf9aa717f1ebb < c4e8eaa75fa0b6bcbfa5356d6195c4ad0e05e57a","Linux >= 456a8a646b2563438c16a9b27decf9aa717f1ebb < 84f8b76d24273175a22713e83e90874e1880d801","Linux >= 456a8a646b2563438c16a9b27decf9aa717f1ebb < 66b689efd08227da2c5ca49b58b30a95d23c695a","Linux >= 456a8a646b2563438c16a9b27decf9aa717f1ebb < b9c310d72783cc2f30d103eed83920a5a29c671a","Linux 5.4"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:10:57.728767Z"},"published":"2026-04-24","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:20:15.934Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-31570","references":[{"url":"https://git.kernel.org/stable/c/e7c99348b0612b2bc02d5ce6ff9873261cc7605f"},{"url":"https://git.kernel.org/stable/c/999ca48d55a8a46da21519db7e834e5867200379"},{"url":"https://git.kernel.org/stable/c/a025283d7f7404c739225e457fb99db2368bb544"},{"url":"https://git.kernel.org/stable/c/54ecdf76a55e75c1f5085e440f8ab671a3283ef5"},{"url":"https://git.kernel.org/stable/c/c4e8eaa75fa0b6bcbfa5356d6195c4ad0e05e57a"},{"url":"https://git.kernel.org/stable/c/84f8b76d24273175a22713e83e90874e1880d801"},{"url":"https://git.kernel.org/stable/c/66b689efd08227da2c5ca49b58b30a95d23c695a"},{"url":"https://git.kernel.org/stable/c/b9c310d72783cc2f30d103eed83920a5a29c671a"}],"tags":["cve.org"],"epss":0.00412,"epssPercentile":0.33947,"ingestedAt":"2026-10-16T17:24:46.663Z","slug":"CVE-2026-31570","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncan: gw: fix OOB heap access in cgw_csum_crc8_rel()\n\ncgw_csum_crc8_rel() correctly computes bounds-safe indices via calc_idx():\n\n    int from = calc_idx(crc8->from_idx, cf->len);\n    int to   = calc_idx(crc8->to_idx,   cf->len);\n    int res  = calc_idx(crc8->result_idx, cf->len);\n\n    if (from < 0 || to < 0 || res < 0)\n        return;\n\nHowever, the loop and the result write then use the raw s8 fields directly\ninstead of the computed variables:\n\n    for (i = crc8->from_idx; ...)        /* BUG: raw negative index */\n    cf->data[crc8->result_idx] = ...;    /* BUG: raw negative index */\n\nWith from_idx = to_idx = result_idx = -64 on a 64-byte CAN FD frame,\ncalc_idx(-64, 64) = 0 so the guard passes, but the loop iterates with\ni = -64, reading cf->data[-64], and the write goes to cf->data[-64].\nThis write might end up to 56 (7.0-rc) or 40 (<= 6.19) bytes before the\nstart of the canfd_frame on the heap.\n\nThe companion function cgw_csum_xor_rel() uses `from`/`to`/`res`\ncorrectly throughout; fix cgw_csum_crc8_rel() to match.\n\nConfirmed with KASAN on linux-7.0-rc2:\n  BUG: KASAN: slab-out-of-bounds in cgw_csum_crc8_rel+0x515/0x5b0\n  Read of size 1 at addr ffff8880076619c8 by task poc_cgw_oob/62\n\nTo configure the can-gw crc8 checksums CAP_NET_ADMIN is needed.\n\n## Affected\n\n- `Linux >= 456a8a646b2563438c16a9b27decf9aa717f1ebb < e7c99348b0612b2bc02d5ce6ff9873261cc7605f`\n- `Linux >= 456a8a646b2563438c16a9b27decf9aa717f1ebb < 999ca48d55a8a46da21519db7e834e5867200379`\n- `Linux >= 456a8a646b2563438c16a9b27decf9aa717f1ebb < a025283d7f7404c739225e457fb99db2368bb544`\n- `Linux >= 456a8a646b2563438c16a9b27decf9aa717f1ebb < 54ecdf76a55e75c1f5085e440f8ab671a3283ef5`\n- `Linux >= 456a8a646b2563438c16a9b27decf9aa717f1ebb < c4e8eaa75fa0b6bcbfa5356d6195c4ad0e05e57a`\n- `Linux >= 456a8a646b2563438c16a9b27decf9aa717f1ebb < 84f8b76d24273175a22713e83e90874e1880d801`\n- `Linux >= 456a8a646b2563438c16a9b27decf9aa717f1ebb < 66b689efd08227da2c5ca49b58b30a95d23c695a`\n- `Linux >= 456a8a646b2563438c16a9b27decf9aa717f1ebb < b9c310d72783cc2f30d103eed83920a5a29c671a`\n- `Linux 5.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}