Bug 2525420 (CVE-2026-80706)

Summary:	CVE-2026-80706 kernel: can: softing: fw_parse(): validate firmware record spans
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the `softing` module of the Linux kernel. This vulnerability exists within the `fw_parse()` function, which handles firmware records. It fails to properly validate the size of these records against the firmware data, leading to situations where the system can read or write data beyond its intended memory boundaries. This out-of-bounds access could allow an attacker to disclose sensitive information or execute unauthorized code on the system.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-28 07:44:06 UTC

In the Linux kernel, the following vulnerability has been resolved:

can: softing: fw_parse(): validate firmware record spans

fw_parse() reads a fixed record header, a firmware-provided payload,
and a trailing checksum without knowing the end of the firmware blob. A
truncated record can therefore make those reads exceed the blob.

The same record also supplies addresses and lengths for writes into
DPRAM. The generic loader uses wrap-prone mixed signed arithmetic for its
bounds check, while the application loader does not bound the staging
copy at all.

Pass the firmware end to the parser and validate the full source record.
Use a signed wide offset for generic DPRAM records and validate the
application staging span against the mapped DPRAM before copying.

Comment 1 gkamathe 2026-08-31 12:35:33 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026082807-CVE-2026-80706-9c56@gregkh/T