---
id: CVE-2026-5071
title: 'can: Local Denial of Service via SocketCAN Send'
summary: >-
  The SocketCAN implementation validates the length of a user-provided buffer
  containing a socketcan_frame object using only a NET_ASSERT statement in
  zcan_sendto_ctx() before dereferencing it in socketcan_to_can_frame(). In
  production bui…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-125
vendor: zephyrproject-rtos
product: Zephyr
affected:
  - Zephyr < 3.7.2
  - Zephyr >= 4.0.0 < 4.2.2
  - Zephyr >= 4.3.0 < 4.3.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-01T13:51:23.839460Z'
published: '2026-05-30'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:10:26.359Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-5071'
references:
  - url: >-
      https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-c3w6-x7m3-3c58
tags:
  - cve.org
epss: 0.00169
epssPercentile: 0.05849
ingestedAt: '2026-10-15T22:48:25.575Z'
---

## Overview

The SocketCAN implementation validates the length of a user-provided buffer containing a socketcan_frame object using only a NET_ASSERT statement in zcan_sendto_ctx() before dereferencing it in socketcan_to_can_frame(). In production builds where assertions are disabled, a userspace application that controls the length passed to a sendto syscall can supply an incomplete or truncated frame, causing socketcan_to_can_frame() to dereference fields beyond the end of the buffer. This results in an out-of-bounds read that can cause denial-of-service crashes or, because the parsed frame contents are transmitted on the network, leak adjacent memory.

## Affected

- `Zephyr < 3.7.2`
- `Zephyr >= 4.0.0 < 4.2.2`
- `Zephyr >= 4.3.0 < 4.3.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.