CVE-2026-31570

A flaw was found in the Linux kernel's Controller Area Network (CAN) gateway module. An attacker with CAP_NET_ADMIN capabilities could exploit an out-of-bounds heap access vulnerability in the cgw_csum_crc8_rel() function. This flaw occurs due to incorrect index handling, where raw negative indices are used instead of properly calculated bounds-safe indices. Successful exploitation could lead to memory corruption, potentially resulting in a denial of service or information disclosure.

The CAN gateway CRC helper could index past heap metadata for certain relative checksum modes under CAP_NET_ADMIN. Red Hat treats this as a local network-admin attack surface on systems using CAN gateway rules. Install corrected kernels; unloading can-gw removes the feature where policy allows.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the can-gw module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.