Log in Start free

Vulnerability · Published Aug 28, 2026 · Assigned by Linux

CVE-2026-80706can: softing: fw_parse(): validate firmware record spans

High 7.8

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.1%top 98.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: can: softing: fw_parse(): validate firmware record spans fw_parse() reads a fixed record header, a firmware-provided payload, and a trailing checksum without knowing the end of the firmware blob. A truncated record can therefore make those reads exceed the blob. The same record also supplies addresses and lengths for writes into DPRAM. The generic loader uses wrap-prone mixed signed arithmetic for its bounds check, while the application loader does not bound the staging copy at all. Pass the firmware end to the parser and validate the full source record. Use a signed wide offset for generic DPRAM records and validate the application staging span against the mapped DPRAM before copying.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.187-1DEBIAN-CVE-2026-80706
Debian:13linux6.12.105-1DEBIAN-CVE-2026-80706
Debian:14linux7.1.8-1DEBIAN-CVE-2026-80706
Debian:12linux-6.126.12.107-1~deb12u1DEBIAN-CVE-2026-80706
Ubuntu:22.04:LTSlinux5.15.0-198.208UBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinuxno fix listedUBUNTU-CVE-2026-80706
Ubuntu:26.04:LTSlinux7.0.0-42.42UBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-aws5.15.0-1117.124UBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-awsno fix listedUBUNTU-CVE-2026-80706
Ubuntu:26.04:LTSlinux-aws7.0.0-1016.17UBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-aws-6.14no fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-aws-6.17no fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-aws-6.8no fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-aws-7.0no fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-azure5.15.0-1123.132UBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-azureno fix listedUBUNTU-CVE-2026-80706
Ubuntu:26.04:LTSlinux-azureno fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-azure-6.14no fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-azure-6.17no fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-azure-6.8no fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-azure-7.0no fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1122.131UBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-azure-fdeno fix listedUBUNTU-CVE-2026-80706
Ubuntu:26.04:LTSlinux-azure-fdeno fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-azure-fde-6.14no fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-azure-fde-6.17no fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-azure-fde-6.8no fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-azure-fde-7.0no fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-azure-nvidiano fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-azure-nvidia-6.14no fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-gcp5.15.0-1118.128UBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-gcpno fix listedUBUNTU-CVE-2026-80706
Ubuntu:26.04:LTSlinux-gcp7.0.0-1016.18UBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-gcp-6.14no fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-gcp-6.17no fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-gcp-6.8no fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-gcp-7.0no fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-gke5.15.0-1113.119UBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-gkeno fix listedUBUNTU-CVE-2026-80706
Ubuntu:26.04:LTSlinux-gkeno fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1100.108UBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-gkeopno fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-hwe-6.14no fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-hwe-6.17no fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-hwe-6.8no fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-hwe-7.07.0.0-42.42~24.04.1UBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-ibm5.15.0-1111.115UBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-ibmno fix listedUBUNTU-CVE-2026-80706
Ubuntu:26.04:LTSlinux-ibm7.0.0-1017.17UBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-ibm-6.8no fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1112.118UBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-kvm5.15.0-1109.114UBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-195.205UBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-lowlatencyno fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.8no fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1112.113UBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-nvidiano fix listedUBUNTU-CVE-2026-80706
Ubuntu:26.04:LTSlinux-nvidiano fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-nvidia-6.11no fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-nvidia-6.17no fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-nvidia-6.8no fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-nvidia-7.0no fix listedUBUNTU-CVE-2026-80706
Ubuntu:26.04:LTSlinux-nvidia-bosno fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-nvidia-lowlatencyno fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-nvidia-tegra5.15.0-1070.72UBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-nvidia-tegra6.8.0-1038.42UBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-nvidia-tegra-igx5.15.0-1059.59UBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-oem-6.11no fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-oem-6.14no fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-oem-6.17no fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-oem-6.8no fix listedUBUNTU-CVE-2026-80706
Ubuntu:26.04:LTSlinux-oem-7.07.0.0-1017.17UBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-oracle5.15.0-1114.120UBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-oracleno fix listedUBUNTU-CVE-2026-80706
Ubuntu:26.04:LTSlinux-oracle7.0.0-1015.16UBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-oracle-6.14no fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-oracle-6.17no fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-oracle-6.8no fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-oracle-7.0no fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-raspino fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-raspino fix listedUBUNTU-CVE-2026-80706
Ubuntu:26.04:LTSlinux-raspino fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-80706
Ubuntu:26.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-80706
Ubuntu:26.04:LTSlinux-riscv7.0.0-42.42.1UBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-riscv-6.14no fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-riscv-6.17no fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-riscv-6.8no fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-riscv-7.07.0.0-42.42.1~24.04.1UBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-vmwareno fix listedUBUNTU-CVE-2026-80706
Ubuntu:24.04:LTSlinux-xilinxno fix listedUBUNTU-CVE-2026-80706
Ubuntu:22.04:LTSlinux-xilinx-zynqmp5.15.0-1080.84UBUNTU-CVE-2026-80706

Affected products (as reported)

VendorProductVersions
Linux Linux 03fd3cf5a179da12e6bee5e9d74b648aff68dc4c – before f6d9a6a9512430b395a1940d7b216394fd02d30b03fd3cf5a179da12e6bee5e9d74b648aff68dc4c – before 84c850b08fc0d671c245144b619683129b55690a03fd3cf5a179da12e6bee5e9d74b648aff68dc4c – before d0eac0ea7cf493e787fd7b4a556e43ef03cb4b5003fd3cf5a179da12e6bee5e9d74b648aff68dc4c – before ae588e5b9cc268de1aabf30f939f0870717ca16403fd3cf5a179da12e6bee5e9d74b648aff68dc4c – before ad331e26fd213a19fee0de18cdacd67b7ff5b47803fd3cf5a179da12e6bee5e9d74b648aff68dc4c – before 2ee477e541a6d5e434d6a4041c6b677ab42e1d8203fd3cf5a179da12e6bee5e9d74b648aff68dc4c – before 808ed899dcf8bdef66894fda5eb7ee4bb0eb8dc103fd3cf5a179da12e6bee5e9d74b648aff68dc4c – before 856d6cb04e5407523566b075841dcd6423757d1c
Linux Linux 2.6.38

References