Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-31570— can: gw: fix OOB heap access in cgw_csum_crc8_rel()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于can gw中cgw_csum_crc8_rel函数使用原始s8字段而非计算变量，可能导致堆越界访问。

CVSS 8.8 · High EPSS 0.41% · P34

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 456a8a646b2563438c16a9b27decf9aa717f1ebb< e7c99348b0612b2bc02d5ce6ff9873261cc7605f affected
456a8a646b2563438c16a9b27decf9aa717f1ebb< 999ca48d55a8a46da21519db7e834e5867200379 affected
456a8a646b2563438c16a9b27decf9aa717f1ebb< a025283d7f7404c739225e457fb99db2368bb544 affected
456a8a646b2563438c16a9b27decf9aa717f1ebb< 54ecdf76a55e75c1f5085e440f8ab671a3283ef5 affected
456a8a646b2563438c16a9b27decf9aa717f1ebb< c4e8eaa75fa0b6bcbfa5356d6195c4ad0e05e57a affected
456a8a646b2563438c16a9b27decf9aa717f1ebb< 84f8b76d24273175a22713e83e90874e1880d801 affected
456a8a646b2563438c16a9b27decf9aa717f1ebb< 66b689efd08227da2c5ca49b58b30a95d23c695a affected
456a8a646b2563438c16a9b27decf9aa717f1ebb< b9c310d72783cc2f30d103eed83920a5a29c671a affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-31570

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
can: gw: fix OOB heap access in cgw_csum_crc8_rel()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: can: gw: fix OOB heap access in cgw_csum_crc8_rel() cgw_csum_crc8_rel() correctly computes bounds-safe indices via calc_idx(): int from = calc_idx(crc8->from_idx, cf->len); int to = calc_idx(crc8->to_idx, cf->len); int res = calc_idx(crc8->result_idx, cf->len); if (from < 0 || to < 0 || res < 0) return; However, the loop and the result write then use the raw s8 fields directly instead of the computed variables: for (i = crc8->from_idx; ...) /* BUG: raw negative index */ cf->data[crc8->result_idx] = ...; /* BUG: raw negative index */ With from_idx = to_idx = result_idx = -64 on a 64-byte CAN FD frame, calc_idx(-64, 64) = 0 so the guard passes, but the loop iterates with i = -64, reading cf->data[-64], and the write goes to cf->data[-64]. This write might end up to 56 (7.0-rc) or 40 (<= 6.19) bytes before the start of the canfd_frame on the heap. The companion function cgw_csum_xor_rel() uses `from`/`to`/`res` correctly throughout; fix cgw_csum_crc8_rel() to match. Confirmed with KASAN on linux-7.0-rc2: BUG: KASAN: slab-out-of-bounds in cgw_csum_crc8_rel+0x515/0x5b0 Read of size 1 at addr ffff8880076619c8 by task poc_cgw_oob/62 To configure the can-gw crc8 checksums CAP_NET_ADMIN is needed.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于can gw中cgw_csum_crc8_rel函数使用原始s8字段而非计算变量，可能导致堆越界访问。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 456a8a646b2563438c16a9b27decf9aa717f1ebb ~ e7c99348b0612b2bc02d5ce6ff9873261cc7605f -
Linux Linux 5.4 -

II. Public POCs for CVE-2026-31570

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-31570

请登录查看更多情报信息。

Same Patch Batch · Linux · 2026-04-24 · 138 CVEs total

CVE-2026-31633 9.8 CRITICAL rxrpc: Fix integer overflow in rxgk_verify_response()
CVE-2026-31589 9.8 CRITICAL mm: call ->free_folio() directly in folio_unmap_invalidate()
CVE-2026-31637 9.8 CRITICAL rxrpc: reject undecryptable rxkad response tickets
CVE-2026-31669 9.8 CRITICAL mptcp: fix slab-use-after-free in __inet_lookup_established
CVE-2026-31668 9.8 CRITICAL seg6: separate dst_cache for input and output paths in seg6 lwtunnel
CVE-2026-31536 9.8 CRITICAL smb: server: let send_done handle a completion without IB_SEND_SIGNALED
CVE-2026-31649 9.8 CRITICAL net: stmmac: fix integer underflow in chain mode
CVE-2026-31607 9.8 CRITICAL usbip: validate number_of_packets in usbip_pack_ret_submit()
CVE-2026-31608 9.8 CRITICAL smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list
CVE-2026-31609 9.8 CRITICAL smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush()
CVE-2026-31657 9.8 CRITICAL batman-adv: hold claim backbone gateways by reference
CVE-2026-31659 9.8 CRITICAL batman-adv: reject oversized global TT response buffers
CVE-2026-31636 9.1 CRITICAL rxrpc: fix RESPONSE authenticator parser OOB read
CVE-2026-31629 8.8 HIGH nfc: llcp: add missing return after LLCP_CLOSED checks
CVE-2026-31588 8.8 HIGH KVM: x86: Use scratch field in MMIO fragment to hold small write values
CVE-2026-31558 8.8 HIGH LoongArch: KVM: Make kvm_get_vcpu_by_cpuid() more robust
CVE-2026-31553 8.8 HIGH KVM: arm64: Fix the descriptor address in __kvm_at_swap_desc()
CVE-2026-31622 8.8 HIGH NFC: digital: Bounds check NFC-A cascade depth in SDD response handler
CVE-2026-31611 8.6 HIGH ksmbd: require 3 sub-authorities before reading sub_auth[2]
CVE-2026-31631 8.2 HIGH rxrpc: Fix buffer overread in rxgk_do_verify_authenticator()

Showing top 20 of 138 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-31570

No comments yet

Leave a comment