{"id":"CVE-2026-5071","title":"can: Local Denial of Service via SocketCAN Send","summary":"The SocketCAN implementation validates the length of a user-provided buffer containing a socketcan_frame object using only a NET_ASSERT statement in zcan_sendto_ctx() before dereferencing it in socketcan_to_can_frame(). In production bui…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","cvssSource":"cna","cwe":["CWE-125"],"vendor":"zephyrproject-rtos","product":"Zephyr","affected":["Zephyr < 3.7.2","Zephyr >= 4.0.0 < 4.2.2","Zephyr >= 4.3.0 < 4.3.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-06-01T13:51:23.839460Z"},"published":"2026-05-30","updated":"2026-10-15","sourceUpdated":"2026-10-15T22:10:26.359Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-5071","references":[{"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-c3w6-x7m3-3c58"}],"tags":["cve.org"],"epss":0.00169,"epssPercentile":0.05849,"ingestedAt":"2026-10-15T22:48:25.575Z","slug":"CVE-2026-5071","body":"## Overview\n\nThe SocketCAN implementation validates the length of a user-provided buffer containing a socketcan_frame object using only a NET_ASSERT statement in zcan_sendto_ctx() before dereferencing it in socketcan_to_can_frame(). In production builds where assertions are disabled, a userspace application that controls the length passed to a sendto syscall can supply an incomplete or truncated frame, causing socketcan_to_can_frame() to dereference fields beyond the end of the buffer. This results in an out-of-bounds read that can cause denial-of-service crashes or, because the parsed frame contents are transmitted on the network, leak adjacent memory.\n\n## Affected\n\n- `Zephyr < 3.7.2`\n- `Zephyr >= 4.0.0 < 4.2.2`\n- `Zephyr >= 4.3.0 < 4.3.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}