CVE-2026-31570: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-31570 Overview

CVE-2026-31570 is an out-of-bounds heap access vulnerability in the Linux kernel's CAN (Controller Area Network) gateway subsystem. The vulnerability exists in the cgw_csum_crc8_rel() function, which correctly computes bounds-safe indices via calc_idx() but then incorrectly uses the raw signed 8-bit fields directly in the loop and result write operations instead of the computed safe variables.

Critical Impact
This vulnerability allows an attacker with adjacent network access to trigger out-of-bounds heap reads and writes, potentially leading to information disclosure, denial of service, or arbitrary code execution in kernel context. Exploitation requires CAP_NET_ADMIN capability to configure can-gw CRC8 checksums.

Affected Products

Linux Kernel versions prior to patched releases
Linux Kernel 5.4 and subsequent versions
Linux Kernel 7.0 release candidates (rc1 through rc7)

Discovery Timeline

April 24, 2026 - CVE-2026-31570 published to NVD
April 27, 2026 - Last updated in NVD database

Technical Details for CVE-2026-31570

Vulnerability Analysis

The vulnerability resides in the cgw_csum_crc8_rel() function within the CAN gateway module. While the function properly validates array indices by computing bounds-safe values through the calc_idx() helper function, a critical programming error causes the subsequent loop iteration and data write operations to use the original raw signed 8-bit (s8) fields instead of the validated indices.

When processing a 64-byte CAN FD frame with from_idx, to_idx, and result_idx all set to -64, the calc_idx(-64, 64) calculation returns 0, allowing the bounds check to pass. However, the loop then iterates starting from i = -64, causing out-of-bounds heap access when reading cf->data[-64]. Similarly, the result write operation accesses cf->data[-64], writing data up to 56 bytes (on 7.0-rc) or 40 bytes (on kernel versions <= 6.19) before the start of the canfd_frame structure on the heap.

The companion function cgw_csum_xor_rel() correctly uses the computed safe variables (from/to/res) throughout its implementation, demonstrating that this was an oversight rather than a design flaw.

Root Cause

The root cause is a variable naming and usage inconsistency in the cgw_csum_crc8_rel() function. The function computes bounds-safe indices into local variables (from, to, res) but then fails to use these variables in the actual loop and assignment operations. Instead, it directly references the raw structure fields (crc8->from_idx, crc8->to_idx, crc8->result_idx) which can contain negative values that pass validation but cause out-of-bounds memory access.

Attack Vector

The vulnerability is exploitable from an adjacent network by an attacker who can configure CAN gateway rules with malicious CRC8 checksum parameters. The attack requires CAP_NET_ADMIN capability, typically available to root or users with elevated network administration privileges. By crafting specific index values that pass the bounds check but cause negative array indexing, an attacker can read from or write to heap memory outside the allocated canfd_frame buffer.

The vulnerability was confirmed with KASAN (Kernel Address Sanitizer) on linux-7.0-rc2, which reported a slab-out-of-bounds read in cgw_csum_crc8_rel() at address ffff8880076619c8 triggered by the proof-of-concept process poc_cgw_oob.

Detection Methods for CVE-2026-31570

Indicators of Compromise

KASAN reports showing slab-out-of-bounds access in cgw_csum_crc8_rel() function
Kernel panic or system instability when processing CAN FD frames through the gateway
Unusual CAN gateway configuration changes requiring CAP_NET_ADMIN privileges
Processes attempting to configure can-gw CRC8 checksums with negative index values

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) in kernel builds to detect out-of-bounds heap access attempts
Monitor system logs for CAN gateway-related kernel warnings or errors using dmesg | grep -i "can\|gw\|crc8"
Implement audit rules to track changes to CAN gateway configurations requiring CAP_NET_ADMIN

Monitoring Recommendations

Deploy kernel live patching solutions to monitor and protect against exploitation attempts
Configure intrusion detection systems to alert on anomalous CAN traffic patterns
Implement system call auditing for setsockopt() calls related to CAN gateway configuration

How to Mitigate CVE-2026-31570

Immediate Actions Required

Apply the latest kernel security patches from your distribution immediately
Restrict CAP_NET_ADMIN capability to only trusted administrators and processes
Audit systems for unauthorized CAN gateway configurations
Consider disabling CAN gateway functionality if not required in your environment

Patch Information

The Linux kernel maintainers have released patches to fix this vulnerability. The fix ensures that cgw_csum_crc8_rel() uses the computed bounds-safe variables (from, to, res) throughout the function, matching the correct implementation in cgw_csum_xor_rel(). Multiple patch commits are available for different kernel branches:

Workarounds

Blacklist the can-gw kernel module if CAN gateway functionality is not required: echo "blacklist can-gw" >> /etc/modprobe.d/blacklist.conf
Remove CAP_NET_ADMIN from untrusted processes and containers using capabilities management
Use network namespaces to isolate CAN interfaces from untrusted workloads

bash

# Configuration example - Blacklist can-gw module if not needed
echo "blacklist can-gw" >> /etc/modprobe.d/blacklist-can-gw.conf

# Unload the module if currently loaded
rmmod can-gw 2>/dev/null || true

# Verify module is not loaded
lsmod | grep can_gw

# Alternative: Restrict CAP_NET_ADMIN using setcap
# Remove CAP_NET_ADMIN from specific binaries
setcap -r /path/to/untrusted/binary