CVE-2026-31570

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

can: gw: fix OOB heap access in cgw_csum_crc8_rel()

cgw_csum_crc8_rel() correctly computes bounds-safe indices via calc_idx():

int from = calc_idx(crc8->from_idx, cf->len);

int to = calc_idx(crc8->to_idx, cf->len);

int res = calc_idx(crc8->result_idx, cf->len);

if (from < 0 || to < 0 || res < 0)

return;

However, the loop and the result write then use the raw s8 fields directly

instead of the computed variables:

for (i = crc8->from_idx; ...) /* BUG: raw negative index */

cf->data[crc8->result_idx] = ...; /* BUG: raw negative index */

With from_idx = to_idx = result_idx = -64 on a 64-byte CAN FD frame,

calc_idx(-64, 64) = 0 so the guard passes, but the loop iterates with

i = -64, reading cf->data[-64], and the write goes to cf->data[-64].

This write might end up to 56 (7.0-rc) or 40 (<= 6.19) bytes before the

start of the canfd_frame on the heap.

The companion functi

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References