PT-2026-36508

Name of the Vulnerable Software and Affected Versions Open-SAE-J1939 versions prior to commit b6caf884df46435e539b1ecbf92b6c29b345bdfe Description An integer underflow exists in the SAE J1939 Read Transport Protocol Data Transfer function. This allows attackers to write to arbitrary memory by usi...

PT-2026-36513

Name of the Vulnerable Software and Affected Versions cannelloni version 2.0.0 Description A buffer overflow occurs during CAN frame parsing. This issue exists within the parseCANFrame function in parser.cpp and the decodeFrame function in decoder.cpp. Remote attackers can exploit this by sending...

CVE-2026-37539

CVE-2026-37539 affects cannelloni v2.0.0. A buffer overflow in CAN frame parsing (parser.cpp, function parseCANFrame) and in decoding (decoder.cpp, function decodeFrame) enables remote attackers to crash the process or potentially execute arbitrary code by crafting CAN FD frames. This vulnerabili...

CVE-2026-37532

AGL agl-service-can-low-level thru 17.1.12 contains a heap buffer over-read in the isotp-c library. In isotpcontinuereceive receive.c:87-89, the payloadlength for a Single Frame is extracted from a 4-bit nibble in the CAN frame data, yielding values 0-15. However, a standard CAN frame is only 8...

CVE-2026-37534

The Open-SAE-J1939 CAN bus communication protocol library for industrial vehicles is vulnerable to an integer underflow in the SAE_J1939_Read_Transport_Protocol_Data_Transfer function. This flaw exists in versions prior to commit b6caf884df46435e539b1ecbf92b6c29b345bdfe (2025-11-30). An attacker ...

[SECURITY] Fedora 44 Update: qt6-qtserialbus-6.10.3-1.fc44

Qt Serial Bus API provides classes and functions to access the various industrial serial buses and protocols, such as CAN, ModBus, and others...

DEBIAN-CVE-2026-31570

In the Linux kernel, the following vulnerability has been resolved: can: gw: fix OOB heap access in cgwcsumcrc8rel cgwcsumcrc8rel correctly computes bounds-safe indices via calcidx: int from = calcidxcrc8-fromidx, cf-len; int to = calcidxcrc8-toidx, cf-len; int res = calcidxcrc8-resultidx, cf-len...

SUSE CVE-2026-31532

In the Linux kernel, the following vulnerability has been resolved: can: raw: fix ro-uniq use-after-free in rawrcv rawrelease unregisters raw CAN receive filters via canrxunregister, but receiver deletion is deferred with callrcu. This leaves a window where rawrcv may still be running in an RCU...

CVE-2026-31532

A flaw was found in the Linux kernel's Controller Area Network CAN raw socket implementation. A use-after-free vulnerability can occur due to a timing window during the unregistration of CAN receive filters, allowing a freed memory region to be accessed. This could lead to system instability or a...

EUVD-2026-25219

In the Linux kernel, the following vulnerability has been resolved: can: raw: fix ro-uniq use-after-free in rawrcv rawrelease unregisters raw CAN receive filters via canrxunregister, but receiver deletion is deferred with callrcu. This leaves a window where rawrcv may still be running in an RCU...

can: isotp: fix tx.buf use-after-free in isotp_sendmsg()

...

CVE-2026-31474

A flaw was found in the Linux kernel's Controller Area Network CAN ISO-TP isotp module. This vulnerability, known as a use-after-free, occurs when the system attempts to free a memory region while it is still being used. A local attacker could trigger this condition by sending a signal that...

CVE-2026-31474

The CVE-2026-31474 issue affects the Linux kernel’s CAN ISO-TP (isotp) path. The bug is a use-after-free involving isotp_sendmsg() and the so->tx.buf buffer: if a signal interrupts wait_event_interruptible() inside close() while tx.state is ISOTP_SENDING, the release path may free so->tx.bu...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-013791)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013791 advisory. In the Linux kernel, the following vulnerability has been resolved: can: hi311x: populate ndochangemtu to prevent buffer overflow Sending an PFPACKET allows to bypa...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007312)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007312 advisory. In the Linux kernel, the following vulnerability has been resolved: can: j1939: Fix UAF in j1939skmatchfilter during setsockoptSOJ1939FILTER Lock jsk-sk to prevent U...

CVE-2026-23357

A flaw was found in the Linux kernel's mcp251x Controller Area Network CAN driver. A local attacker could trigger a deadlock condition within the mcp251xopen function's error handling path. This occurs when the freeirq function is called while the mpclock mutex is held and an interrupt...

The vulnerability of the m_can_read_fifo() function in the drivers/net/can/m_can/m_can.c file of the Linux kernel’s CAN device support driver allows a hacker to cause a service failure.

The vulnerability of the mcanreadfifo function in the drivers/net/can/mcan/mcan.c file of the Linux kernel’s CAN device support driver exposes confidential information. Exploiting this vulnerability could allow an attacker to cause service failures...

EVerest 安全漏洞

EVerest is an open-source firmware for electric vehicle charging stations developed by EVerest. Versions prior to EVerest 2026.02.0 contained security vulnerabilities. These vulnerabilities were caused by stack buffer overflows during CAN interface initialization, which could lead to stack data...

CVE-2026-23362

A flaw was found in the Linux kernel's Controller Area Network CAN Broadcast Manager BCM module. When the RXRTRFRAME flag is set and a specific Remote Transmission Request RTR frame is received, the bcmtxlock was not properly initialized in the bcmrxsetup function. This missing initialization of...

EUVD-2026-15332

In the Linux kernel, the following vulnerability has been resolved: can: mcp251x: fix deadlock in error path of mcp251xopen The mcp251xopen function call freeirq in its error path with the mpclock mutex held. But if an interrupt already occurred the interrupt handler will be waiting for the mpclo...