PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-5071 zephyrproject-rtos CVE debrief

A medium-severity vulnerability in Zephyr RTOS's SocketCAN implementation allows out-of-bounds memory reads when userspace applications send truncated CAN frames. The flaw exists because buffer length validation relies solely on NET_ASSERT, which is disabled in production builds. An attacker with local access can trigger denial-of-service crashes or leak adjacent memory contents onto the CAN bus.

Vendor
zephyrproject-rtos
Product
Zephyr
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-30
Original CVE updated
2026-07-22
Advisory published
2026-05-30
Advisory updated
2026-07-22

Who should care

Organizations deploying Zephyr RTOS in production environments with SocketCAN networking enabled, particularly in automotive, industrial control, and IoT gateway applications where CAN bus connectivity is exposed to userspace applications.

Technical summary

In Zephyr RTOS, the SocketCAN subsystem's zcan_sendto_ctx() function validates the length of a user-provided socketcan_frame buffer using only NET_ASSERT before passing the buffer to socketcan_to_can_frame(). When assertions are disabled in production builds, a userspace application can supply a buffer shorter than sizeof(struct socketcan_frame), causing socketcan_to_can_frame() to read beyond the buffer boundary. The out-of-bounds data is parsed as CAN frame fields and transmitted on the physical CAN network, enabling both crash-inducing reads and information disclosure. The CVSS 3.1 score of 6.1 (Medium) reflects local attack vector, low privileges, and high availability impact with low confidentiality impact.

Defensive priority

medium

Recommended defensive actions

  • Apply patches from the Zephyr Project security advisory when available
  • Rebuild production firmware with assertions enabled only for development/debug builds if feasible, or implement explicit runtime bounds checks independent of assert macros
  • Audit other SocketCAN and networking code paths for similar assert-dependent validation patterns
  • Monitor CAN bus traffic for anomalous frame contents that may indicate memory leakage
  • Restrict local access to SocketCAN interfaces to trusted applications only

Evidence notes

The vulnerability was disclosed via the Zephyr Project security advisory GHSA-c3w6-x7m3-3c58 and published in the NVD on 2026-05-30. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H) confirms local attack vector with low privileges required, yielding medium overall score. CWE-125 (Out-of-bounds Read) is the identified weakness.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-5071 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-5071

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-5071 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-5071

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.