The vulnerability resides in the Linux kernel’s CAN Softing firmware loader. The fw_parse() routine reads a record header, firmware payload, and checksum without knowing where the firmware blob ends. If the firmware is truncated, the routine can read beyond the blob, and the same data describes addresses and lengths for writing into DPRAM. The generic loader uses signed arithmetic that is wrap-prone for bounds checks, while the application loader performs no bounds check on the staging copy. This combination allows an attacker to craft a firmware image that causes out‑of‑bounds reads or writes to kernel memory. While the CVE text does not explicitly state a remote code execution vector, an out‑of‑bounds write that can modify kernel data or instruction flow is a classic path to privilege escalation or arbitrary code execution. The impact is therefore potentially severe if an attacker supplies a malicious firmware image.

All Linux kernel releases that include the can:softing firmware loader code path prior to the patch are potentially affected. No specific version numbers are provided in the advisory, so any kernel version shipping the default loader without the recent commit is considered vulnerable. Distributions that ship the vanilla Linux kernel are also covered.

The EPSS score of <1% indicates a very low, but non‑zero, probability of exploitation. The CVSS score of 7.8 reflects a high severity, indicating that successful exploitation could lead to local privilege escalation or remote code execution. While the vulnerability is not listed in the CISA KEV catalog, the combination of an out‑of‑bounds memory access and lack of bounds validation in the firmware loader can allow an attacker to manipulate kernel memory. Successful exploitation would require the attacker to load a crafted firmware image through the CAN Softing device node, which typically requires privileged access to the device. The likely attack vector is local or privileged remote access that can submit a malicious firmware file. The risk remains high due to the potential impact, while the exploitation probability remains low as reflected by the EPSS metric.