---
id: CVE-2026-5071
title: >-
  The SocketCAN implementation validates the length of a user-provided buffer
  containing a socketcan_frame object using only a NET_ASSERT statement in
  zcan_sendto_ctx() before dereferencing it in socketcan_to_can_frame()
summary: >-
  The SocketCAN implementation validates the length of a user-provided buffer
  containing a socketcan_frame object using only a NET_ASSERT statement in
  zcan_sendto_ctx() before dereferencing it in socketcan_to_can_frame(). In
  production bui…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H'
cwe:
  - CWE-125
vendor: zephyrproject
product: zephyr
affected:
  - zephyr <= 4.3.0
published: '2026-05-30'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T23:17:37.643'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-5071'
references:
  - url: >-
      https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-c3w6-x7m3-3c58
    label: vulnerabilities@zephyrproject.org
tags:
  - nvd
  - cve.org
epss: 0.00167
epssPercentile: 0.05925
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-01T13:51:23.839460Z'
ingestedAt: '2026-10-15T22:48:25.575Z'
---

## Overview

The SocketCAN implementation validates the length of a user-provided buffer containing a socketcan_frame object using only a NET_ASSERT statement in zcan_sendto_ctx() before dereferencing it in socketcan_to_can_frame(). In production builds where assertions are disabled, a userspace application that controls the length passed to a sendto syscall can supply an incomplete or truncated frame, causing socketcan_to_can_frame() to dereference fields beyond the end of the buffer. This results in an out-of-bounds read that can cause denial-of-service crashes or, because the parsed frame contents are transmitted on the network, leak adjacent memory.

## Affected

- `zephyr <= 4.3.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.