j1939 ReceiveBuffer Leak

Vulnerability analysis

The J1939 transport layer allocates a receive buffer for incoming session data but does not initialize it, so the buffer may contain residual data from previous kernel slab allocations. When userspace reads from this buffer, the uninitialized portions can expose whatever data was left in that memory, potentially including kernel pointers or other sensitive information. The fix replaces the plain buffer allocation with a zeroing variant so the entire receive buffer is cleared before any data is written into it. This can be triggered by any user who can create a J1939 socket over a CAN interface, which requires CAP_NET_ADMIN — a capability an unprivileged user can obtain through user namespaces on systems where they are enabled.