CVE-2026-67560

Bendix EC80 Brake ECU is affected by a stack-based buffer overflow that may allow an attacker to crash the ECU. A crafted payload can then be used to remotely execute arbitrary code or inject arbitrary CAN bus traffic, potentially causing loss of ABS, steering assist, speedometer, and shifting. T...

PT-2026-82774

Bendix EC80 Brake ECU is vulnerable to a stack-based buffer overflow, which may allow an attacker to crash the ECU. A crafted payload can then be used to remotely execute arbitrary code or inject arbitrary CAN bus traffic. This could cause the loss of the ABS function, steering assist, speedomete...

The vulnerability of the cgw_csum_crc8_rel() function in the net/can/gw.c module of the CAN bus subsystem of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the cgwcsumcrc8rel function in the net/can/gw.c module of the Linux operating system’s CAN subsystem relates to access to a memory cell preceding the buffer’s start. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

The vulnerability of the gs_usb_receive_bulk_callback() function in the drivers/net/can/usb/gs_usb.c file of the Linux kernel’s CAN network device driver allows a hacker to induce a service failure.

The vulnerability of the gsusbreceivebulkcallback function in the drivers/net/can/usb/gsusb.c file of the Linux network device driver suite is related to deficiencies in the error reporting mechanism. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the bcm_rx_setup() function in the net/can/bcm.c module of the Linux kernel’s CAN subsystem allows a hacker to cause a service failure.

The vulnerability of the bcmrxsetup function in the net/can/bcm.c module of the Linux kernel’s CAN subsystem is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the ems_usb_read_bulk_callback() function in the drivers/net/can/usb/ems_usb.c module of the Linux network device driver allows a attacker to cause a service failure.

The vulnerability of the emsusbreadbulkcallback function in the drivers/net/can/usb/emsusb.c module of the Linux network device driver framework is related to the occurrence of operations outside the buffer in memory. Exploiting this vulnerability could allow an attacker to cause a service failur...

The vulnerability of the `ucan_read_bulk_callback()` function in the `drivers/net/can/usb/ucan.c` file of the Linux kernel’s CAN network device driver allows a attacker to cause a service failure.

The vulnerability of the ucanreadbulkcallback function in the drivers/net/can/usb/ucan.c file of the Linux network device driver framework leads to uncontrolled resource consumption. Exploiting this vulnerability could allow an attacker to cause service failures...

The vulnerability of the mcp251x_open() function in the drivers/net/can/spi/mcp251x.c file of the Linux kernel’s CAN network device driver allows a hacker to cause a service failure.

The vulnerability of the mcp251xopen function in the drivers/net/can/spi/mcp251x.c file of the Linux kernel’s CAN network device driver is related to the creation of critical data packets. Exploiting this vulnerability could allow an attacker to cause a system failure...

CVE-2026-75369

An out-of-bounds read vulnerability in the CAN::Application::parsePerformFunctionMessage component of SpaceDot AcubeSAT OBC software commit eaf90ec allows attackers to cause a Denial of Service DoS via supplying a crafted CAN message...

CVE-2026-75370

An out-of-bounds read/write vulnerability in the MessageParser::parseECSSTCHeader component of SpaceDot AcubeSAT OBC software commit eaf90ec allows attackers to cause a Denial of Service DoS via supplying a crafted CAN message...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: can: dev: cangetechoskb: prevents calling kfreeskb in a hard IRQ context. If a driver calls cangetechoskb during a hardware IRQ which is often, but not always the case, the WARNONinirq in net/core/skbuff.cskbreleaseheadstate migh...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: can: mcan: pci: added the missing mcanclassfreedev function in probe/remove methods. In mcanpciremove and the error handling path of mcanpciprobe, mcanclassfreedev should be called to release resources allocated by...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: can: afcan: fixed NULL pointer dereferencing in canrcvfilter. Similar to the issue reported in commit 8aa59e355949 “can: afcan: fixed NULL pointer dereferencing in canrxregister”, we need to check for a missing initialization ...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: can: j1939: fix errant WARNONONCE in j1939SESSIONdeactivate The statement “j1939SESSIONdeactivate should be called with a session ref-count of at least 2” is incorrect. In some concurrent scenarios, j1939SESSIONdeactivate can be...

Astra Linux – Vulnerability in gst-plugins-good1.0

GStreamer FLAC File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability, but the attack vectors may vary...

Astra Linux – Vulnerability in gst-plugins-good1.0

GStreamer rtpqdm2depay: Out-of-bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability, but the attack vectors may vary...

Astra Linux – Vulnerability in gst-plugins-bad1.0

GStreamer DVB Subtitles Out-of-Bounds: Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability, but the attack vectors may vary dependi...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: In isotp.bind, there is a need to check the CAN address family. A missing check was added to prevent binds that use a non-AFCAN address family. Syzbot created some code that correctly determined the appropriate size of the sockad...

Astra Linux – Vulnerability in ofono

oFono SMS Decoder Stack-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: can: mcan: mcanreadfifo,echotxevent: The shift timestamp is now set to full 32 bits. In commit 1be37d3b0414 “can: mcan: fix periph RX path: use rx-offload to ensure that packets are sent from the softirq context”, the RX path for...