CVE-2026-80706

A flaw was found in the softing module of the Linux kernel. This vulnerability exists within the fw_parse() function, which handles firmware records. It fails to properly validate the size of these records against the firmware data, leading to situations where the system can read or write data beyond its intended memory boundaries. This out-of-bounds access could allow an attacker to disclose sensitive information or execute unauthorized code on the system.

A flaw was found in the Linux kernel softing CAN driver. The fw_parse() function parses firmware records without validating that the record header, payload, and trailing checksum fit within the supplied firmware blob, and record-provided addresses and lengths are used for writes into the card's mapped DPRAM without sufficient bounds checking. On Red Hat Enterprise Linux 7 (Extended Lifecycle Support) and Red Hat Enterprise Linux 8 (kernel and kernel-rt), a local attacker able to load a crafted or truncated firmware image onto a Softing CAN interface card could cause out-of-bounds reads from kernel memory and out-of-bounds writes to device memory, most realistically resulting in a kernel crash or CAN device malfunction (denial of service). Red Hat Product Security rates this flaw MODERATE (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access to the firmware-loading path on systems with the affected Softing hardware; this is lower than the upstream CVEORG rating of IMPORTANT (7.8), which assumes full confidentiality and integrity impact. The fix for the affected RHEL 7 and RHEL 8 streams is currently deferred to a future update because practical exposure is limited to privileged local firmware loading; the residual risk is denial of service on systems where untrusted firmware images can be installed. Red Hat Enterprise Linux 6, 9, and 10 and Red Hat In-Vehicle OS are not affected because the vulnerable code is not present in those products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.