CVE-2026-80707

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network

Received J1939 TP/ETP RTS frames enter j1939_can_recv()→j1939_tp_recv()→j1939_xtp_rx_rts_session_new()→j1939_session_fresh_new() from the CAN receive path with no local syscall; telematics/CAN gateways routinely expose J1939 to remote peers, consistent with prior kernel CNA scores for the same subsystem (e.g. CVE-2023-52887, CVE-2026-22997).

AC:LAttack complexity, low

The attacker controls RTS-declared message size, DATA/EOMA sequencing, and timing; skb_put() leaves the entire allocation uninitialized, j1939_xtp_rx_eoma_one() completes without verifying all data packets arrived, and recvmsg returns the full skb length—reliably mixing attacker data with residual heap bytes (including trailing padding).

PR:NPrivileges required, none

J1939 receive processing has no authentication gate; an unauthenticated CAN/J1939 peer can send crafted transport-control frames to a victim ECU that already runs a bound J1939 socket (normal automotive, trucking, and industrial deployments) without any Linux account or capability on the target.

UI:NUser interaction, none

No victim interaction is required beyond the target already operating the J1939 stack with a bound socket; the attacker only transmits crafted frames on the bus to trigger session allocation and completion.

S:UScope, unchanged

Uninitialized kernel heap contents are disclosed to matching local J1939 socket owners via recvmsg; impact remains within the same kernel security authority and does not cross VM, IOMMU, or sandbox boundaries.

C:HConfidentiality impact, high

j1939_session_fresh_new() allocates the receive buffer with skb_put() instead of skb_put_zero(), so unfilled bytes retain prior slab contents; on completion j1939_session_completed() delivers the full total_message_size buffer (up to tp_max_packet_size, commonly ~65K) to userspace, disclosing kernel pointers and heap data.

I:NIntegrity impact, none

The bug only omits zero-initialization of the receive skb; there is no out-of-bounds write, use-after-free, or other memory-corruption primitive enabling integrity impact.

A:NAvailability impact, none

Sessions complete or abort normally without kernel panic, oops, hang, or resource exhaustion; the vulnerability is an information-disclosure defect with no availability impact.