{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-31570",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-31570",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-04-24T14:35:49.435Z",
    "updatedAt": "2026-10-19T18:55:59.285Z",
    "importedAt": "2026-10-24T01:58:02.025Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "can: gw: fix OOB heap access in cgw_csum_crc8_rel()",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: gw: fix OOB heap access in cgw_csum_crc8_rel()\n\ncgw_csum_crc8_rel() correctly computes bounds-safe indices via calc_idx():\n\n    int from = calc_idx(crc8->from_idx, cf->len);\n    int to   = calc_idx(crc8->to_idx,   cf->len);\n    int res  = calc_idx(crc8->result_idx, cf->len);\n\n    if (from < 0 || to < 0 || res < 0)\n        return;\n\nHowever, the loop and the result write then use the raw s8 fields directly\ninstead of the computed variables:\n\n    for (i = crc8->from_idx; ...)        /* BUG: raw negative index */\n    cf->data[crc8->result_idx] = ...;    /* BUG: raw negative index */\n\nWith from_idx = to_idx = result_idx = -64 on a 64-byte CAN FD frame,\ncalc_idx(-64, 64) = 0 so the guard passes, but the loop iterates with\ni = -64, reading cf->data[-64], and the write goes to cf->data[-64].\nThis write might end up to 56 (7.0-rc) or 40 (<= 6.19) bytes before the\nstart of the canfd_frame on the heap.\n\nThe companion function cgw_csum_xor_rel() uses `from`/`to`/`res`\ncorrectly throughout; fix cgw_csum_crc8_rel() to match.\n\nConfirmed with KASAN on linux-7.0-rc2:\n  BUG: KASAN: slab-out-of-bounds in cgw_csum_crc8_rel+0x515/0x5b0\n  Read of size 1 at addr ffff8880076619c8 by task poc_cgw_oob/62\n\nTo configure the can-gw crc8 checksums CAP_NET_ADMIN is needed.",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "456a8a646b2563438c16a9b27decf9aa717f1ebb",
              "status": "affected",
              "versionType": "git",
              "lessThan": "e7c99348b0612b2bc02d5ce6ff9873261cc7605f"
            },
            {
              "version": "456a8a646b2563438c16a9b27decf9aa717f1ebb",
              "status": "affected",
              "versionType": "git",
              "lessThan": "999ca48d55a8a46da21519db7e834e5867200379"
            },
            {
              "version": "456a8a646b2563438c16a9b27decf9aa717f1ebb",
              "status": "affected",
              "versionType": "git",
              "lessThan": "a025283d7f7404c739225e457fb99db2368bb544"
            },
            {
              "version": "456a8a646b2563438c16a9b27decf9aa717f1ebb",
              "status": "affected",
              "versionType": "git",
              "lessThan": "54ecdf76a55e75c1f5085e440f8ab671a3283ef5"
            },
            {
              "version": "456a8a646b2563438c16a9b27decf9aa717f1ebb",
              "status": "affected",
              "versionType": "git",
              "lessThan": "c4e8eaa75fa0b6bcbfa5356d6195c4ad0e05e57a"
            },
            {
              "version": "456a8a646b2563438c16a9b27decf9aa717f1ebb",
              "status": "affected",
              "versionType": "git",
              "lessThan": "84f8b76d24273175a22713e83e90874e1880d801"
            },
            {
              "version": "456a8a646b2563438c16a9b27decf9aa717f1ebb",
              "status": "affected",
              "versionType": "git",
              "lessThan": "66b689efd08227da2c5ca49b58b30a95d23c695a"
            },
            {
              "version": "456a8a646b2563438c16a9b27decf9aa717f1ebb",
              "status": "affected",
              "versionType": "git",
              "lessThan": "b9c310d72783cc2f30d103eed83920a5a29c671a"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "5.4",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "5.4"
            },
            {
              "version": "5.10.253",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "version": "5.15.203",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "version": "6.1.168",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "version": "6.6.131",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "version": "6.12.80",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "version": "6.18.21",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "version": "6.19.11",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.19.*"
            },
            {
              "version": "7.0",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}