HIGH Introduced in 5.4
j1939 ReceiveBuffer Leak
CVE-2026-80707
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
KernelScan AI3.3LOW
01Description
In the Linux kernel, the following vulnerability has been resolved: can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer Zero the allocated buffer in j1939_session_fresh_new() to ensure it contains no residual data. While there is a potential performance impact if users allocate maximum sized ETP buffers, most real-world use cases are not noticeably affected since the maximum known buffer size is typically around 65K. [mkl: add Message-ID]
02KernelScan AI Analysis
Risk summary
The J1939 CAN transport layer allocates a receive buffer without zeroing it, allowing stale kernel heap data to leak to userspace when the buffer is read. Any user who can open a J1939 socket — which requires CAP_NET_ADMIN, obtainable via user namespaces on unhardened systems — can trigger this. The leaked data may contain sensitive kernel information from prior allocations.
Vulnerability analysis
The J1939 transport layer allocates a receive buffer for incoming session data but does not initialize it, so the buffer may contain residual data from previous kernel slab allocations. When userspace reads from this buffer, the uninitialized portions can expose whatever data was left in that memory, potentially including kernel pointers or other sensitive information. The fix replaces the plain buffer allocation with a zeroing variant so the entire receive buffer is cleared before any data is written into it. This can be triggered by any user who can create a J1939 socket over a CAN interface, which requires CAP_NET_ADMIN — a capability an unprivileged user can obtain through user namespaces on systems where they are enabled.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 5.4 | 5.10.265 | 348818277a36 |
| 6.1 | 5.4 | 6.1.183 | bbfa49d1e287 |
| 6.6 | 5.4 | 6.6.151 | 194d67e92197 |
| 6.12 | 5.4 | 6.12.103 | 038bad8e16c2 |
| 7.1 | 5.4 | 7.1.8 | d5b3613c7d69 |
| 6.18 | 5.4 | 6.18.44 | 8604a3b81b9d |
| mainline | 5.4 | 7.2 | eb96c5890792 |
| 5.15 | 5.4 | 5.15.216 | f3e120a34b33 |
| cip/5.10 | 5.4 | 5.10.268-cip77 | 348818277a36 |
| cip/5.10-rt | 5.4 | 5.10.268-cip77-rt34 | 348818277a36 |
| cip/6.1 | 5.4 | 6.1.187-cip60 | bbfa49d1e287 |
| cip/6.12 | 5.4 | 6.12.104-cip30 | 038bad8e16c2 |