CVE-2026-80706

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

Malformed firmware is consumed only via request_firmware() from the local firmware search path during softing_pdev_probe/softing_card_boot; CAN frames, network protocols, and bus traffic never reach fw_parse(), so exploitation requires local presence on the host loading the blob.

AC:LAttack complexity, low

The attacker fully controls record type, addr, len, and payload in the Structured Binary Format file; a truncated final record or integer-wrapping addr/len values deterministically bypass the old bounds checks and trigger out-of-bounds reads/writes on every probe without races or layout luck.

PR:LPrivileges required, low

fw_parse() performs no capability or credential checks, firmware paths under /lib/firmware/softing-4.6/ are writable by vendor/OTA accounts on many embedded and diagnostic deployments, and the sysfs firmware fallback loader exposes world-writable loading/data during request_firmware(), so a low-privileged local user can supply the malicious image.

UI:NUser interaction, none

Once the crafted blob is in place, parsing runs automatically from softing_card_boot during PCMCIA/platform probe on card insert or module bind; the attacker can trigger reload by reinserting the card or reloading softingcs themselves without requiring a separate victim action.

S:UScope, unchanged

The out-of-bounds reads and MMIO/DPRAM writes corrupt host kernel memory and the mapped Softing card region only; this is not a VM escape, IOMMU bypass, or other cross-security-authority breakout.

C:HConfidentiality impact, high

fw_parse() reads record headers, variable-length payloads, and trailing checksums past the firmware buffer end, performing an out-of-bounds kernel read of adjacent vmalloc/kmalloc memory that can disclose sensitive kernel contents beyond a few bytes.

I:HIntegrity impact, high

Records supply addr and len used in memcpy_toio() into card DPRAM; the pre-fix mixed signed/unsigned bounds check could wrap and softing_load_app_fw staged copies without any DPRAM bound, enabling attacker-controlled out-of-bounds MMIO writes exploitable for memory corruption.

A:HAvailability impact, high

Out-of-bounds MMIO writes past the ioremap window and out-of-bounds firmware-buffer reads readily fault on unmapped pages or corrupt critical DPRAM state, producing kernel oops/panic and denying use of the CAN interface on probe.