A flaw in the Linux kernel's can:softing firmware loader allows the fw_parse function to read a header, payload, and checksum without knowing the blob end, so a truncated record can overflow the buffer. The loader also uses signed wrap‑prone arithmetic for bounds checks in the generic path and performs no bounds checking at all for application staging, enabling an attacker with a crafted firmware image to write arbitrary data into DPRAM or read from unintended memory locations. When exploited, these out‑of‑bounds accesses can result in remote code execution or system instability.

All Linux kernel releases that contain the can:softing firmware loader code path before the fix, including typical distributions that ship the default kernel. The affected vendor is the Linux Foundation / kernel project. No specific version numbers are given, so any kernel that has not yet been updated with the patch is considered vulnerable.

No CVSS score or EPSS data are publicly available, and the vulnerability is not in the CISA KEV catalog. The flaw enables arbitrary memory reads and writes via the firmware loader, which normally requires privileged access to submit a firmware image. Therefore, successful exploitation requires local or privileged remote access, but if achieved the impact is high, potentially leading to remote code execution or denial of service.