CVE-2026-5071: SocketCAN Buffer Validation DoS Vulnerability

CVE-2026-5071 Overview

CVE-2026-5071 is an out-of-bounds read vulnerability [CWE-125] in the Zephyr RTOS SocketCAN implementation. The flaw resides in zcan_sendto_ctx(), which validates the length of a user-supplied buffer containing a socketcan_frame object using only a NET_ASSERT statement. In production builds where assertions are compiled out, socketcan_to_can_frame() dereferences fields past the end of a truncated buffer. A local userspace application can trigger crashes or leak adjacent memory by transmitting the parsed frame contents on the CAN network.

Critical Impact
Local attackers controlling the sendto length argument can crash the system or exfiltrate adjacent kernel memory over the CAN bus.

Affected Products

Zephyr RTOS SocketCAN subsystem
Production builds with NET_ASSERT disabled
Applications exposing SocketCAN sendto to userspace

Discovery Timeline

2026-05-30 - CVE-2026-5071 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-5071

Vulnerability Analysis

The Zephyr networking stack exposes a SocketCAN interface that accepts frames from userspace through the sendto syscall. The handler zcan_sendto_ctx() is responsible for validating the buffer length before parsing the inbound socketcan_frame structure. Length validation is performed exclusively through NET_ASSERT, a debug-time macro that compiles to a no-op in production firmware images.

When assertions are disabled, an undersized buffer flows directly into socketcan_to_can_frame(). That function reads structure fields at fixed offsets, dereferencing memory beyond the end of the caller-supplied buffer. The resulting out-of-bounds read pulls adjacent stack or heap contents into the parsed frame. Because the parsed frame is then transmitted on the CAN network, the leaked bytes become observable to any device on the bus.

Root Cause

The root cause is reliance on a debug assertion for security-critical input validation. NET_ASSERT is intended to catch programming errors during development, not enforce trust boundaries between userspace and kernel components. Removing the assertion in production strips all length checking from the code path.

Attack Vector

Exploitation requires local code execution with permission to open a SocketCAN socket and invoke sendto. The attacker passes a len argument smaller than sizeof(struct socketcan_frame). zcan_sendto_ctx() accepts the call, and socketcan_to_can_frame() reads past the buffer to populate fields such as the CAN ID, DLC, and payload bytes. The transmitted frame discloses the out-of-bounds memory to network peers, or triggers a fault if the read crosses an unmapped page.

See the GitHub Security Advisory GHSA-c3w6-x7m3-3c58 for vendor-supplied technical details.

Detection Methods for CVE-2026-5071

Indicators of Compromise

Anomalous CAN frames containing high-entropy or non-protocol byte patterns transmitted from a Zephyr-based node.
Unexpected system resets or watchdog reboots correlated with sendto calls on AF_CAN sockets.
Userspace processes opening SocketCAN sockets with truncated sendto length arguments.

Detection Strategies

Audit firmware builds to confirm whether CONFIG_ASSERT and NET_ASSERT are enabled in shipped images.
Instrument zcan_sendto_ctx() with explicit length checks and log requests where len < sizeof(struct socketcan_frame).
Capture CAN bus traffic and compare transmitted payload bytes against the buffers supplied by sending applications.

Monitoring Recommendations

Monitor for crash logs and kernel oops events on Zephyr devices using SocketCAN.
Track CAN frame transmissions for payload bytes that do not match expected application-layer protocols.
Alert on userspace binaries that invoke sendto on AF_CAN sockets with non-standard length values.

How to Mitigate CVE-2026-5071

Immediate Actions Required

Apply the upstream Zephyr patch referenced in GHSA-c3w6-x7m3-3c58 and rebuild affected firmware images.
Enable CONFIG_ASSERT in production builds as a defense-in-depth measure until the patched release is deployed.
Restrict which userspace components can open AF_CAN sockets on multi-process Zephyr deployments.

Patch Information

The Zephyr project released a fix that replaces the NET_ASSERT length check with an explicit runtime validation in zcan_sendto_ctx(). Buffers smaller than sizeof(struct socketcan_frame) are rejected before socketcan_to_can_frame() is invoked. Consult the upstream advisory for the specific commit hashes and affected branch ranges.

Workarounds

Rebuild firmware with assertions enabled so NET_ASSERT enforces the length check at runtime.
Wrap SocketCAN sendto calls in a userspace shim that validates buffer length before invoking the syscall.
Disable SocketCAN support in builds that do not require CAN connectivity.

bash

# Configuration example: enable assertions as a temporary mitigation
CONFIG_ASSERT=y
CONFIG_ASSERT_LEVEL=2
CONFIG_NET_ASSERT=y