On April 24, 2026, the Linux kernel project disclosed CVE-2026-31570, a heap out-of-bounds vulnerability in the CAN gateway subsystem. The flaw lets attackers corrupt kernel memory on systems with CAN networking enabled—a risk that extends to Windows machines running WSL with custom kernels.
The Vulnerability at a Glance
CVE-2026-31570 lives in the Linux kernel's SocketCAN stack, specifically in the CAN gateway's CRC8 checksum handling. The buggy function, cgwcsumcrc8rel() in net/can/gw.c, computes safe array indices using a helper called calcidx(), then promptly ignores them. Instead, the code uses raw signed fields that can be negative, leading to reads and writes far outside the intended CAN frame buffer. On a 64‑byte CAN FD frame, setting fromidx, toidx, and resultidx to -64 causes accesses 56 bytes before the start of the frame on Linux 7.0‑rc2—a classic slab out‑of‑bounds, as confirmed by kernel memory sanitizers.
The fix is a one‑line change: replace the raw fields with the validated indices, matching the safer pattern already used in the companion XOR checksum function. The Linux CNA published the record with fixed versions across all major stable kernels: 5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11, and the 7.0 development line. The vulnerability was introduced when CRC8 support was added to the CAN gateway back in kernel 5.4, so anything unpatched from that version forward is affected.
WSL and Windows Users: Are You Affected?
The bug is purely Linux kernel code, but it seeps into the Windows world through Microsoft’s Windows Subsystem for Linux 2. WSL 2 runs a full Linux kernel, and Microsoft encourages custom kernels for specialized workloads. If you’ve compiled your own WSL kernel with CAN support enabled (CONFIGCANGW=y or m), the vulnerable code is present. Even the default Microsoft‑maintained WSL kernel might include it if Microsoft enabled the option—users should verify.
Azure virtual machines running Linux, IoT devices on Azure Sphere or Azure IoT Hub, and containers granted the CAPNETADMIN capability are also in the blast radius. For development environments where WSL is used to build automotive or industrial automation software, the attack surface is real: an unprivileged attacker who can create a network namespace with CAPNETADMIN could craft a CAN frame that triggers the out‑of‑bounds access, potentially escalating privileges or crashing the kernel.
Everyday Windows users who simply wsl --install Ubuntu and run packages are unlikely to be exposed because the default kernel likely omits CAN gateway support. But power users who tweak kernel configs or pull in custom kernels from GitHub repositories should check immediately.
How We Got Here: The Root Cause
SocketCAN is Linux’s built‑in framework for Controller Area Network communication, the bus that underpins modern vehicles, industrial machines, and robotics. The CAN gateway is an optional kernel module that routes and modifies CAN frames, including adding checksums like CRC8. In 2020, the kernel 5.4 cycle added cgwcsumcrc8rel() to compute relative CRC8 checksums over a frame’s data.
The programmer correctly anticipated that user‑supplied offsets (fromidx, toidx, resultidx) might be negative and added calcidx() to normalize them. But the normalization result was stored in local variables (from, to, res) that were only used for a bounds check. The actual byte‑copying loop and final checksum write used the original, unvalidated fields. With negative indices, the code sailed past the if (from < 0 || to < 0 || res < 0) guard because calcidx() turns a negative index into a valid one (e.g., calcidx(-64, 64) yields 0), yet the raw -64 was still used for member access, landing in heap memory adjacent to the frame buffer.
This class of “validated but not used” bug is common in C, especially in kernel drivers that juggle signed and unsigned values. The companion XOR function got similar validation right, so CRC8 was simply an imperfect copy‑paste.
Immediate Steps to Protect Your Systems
First, determine whether you’re in the window. For any Linux environment—WSL, VM, container, or bare metal—run these checks:
# Check kernel version
uname -rCheck if CAN gateway module is available
modinfo can-gw 2>/dev/null | head -1Check kernel config for CANGW (where possible)
grep CONFIGCANGW /proc/config.gz 2>/dev/null || grep CONFIGCANGW /boot/config-$(uname -r)
If you see CONFIGCANGW=y or a loaded can-gw module, you are exposed. If the module is present but not loaded, you’re safer but should still patch before an attacker can load it.
For WSL users, Microsoft publishes the source for its default kernel on GitHub. As of this writing, Microsoft has not announced whether its official WSL kernel includes the CAN gateway. Check the release notes for your WSL kernel version. If you use a custom kernel, rebuild with the patch applied. The simplest path for most WSL users is to ensure wsl --update is run regularly; Microsoft typically rolls kernel fixes into its updates after they appear upstream.
Other Linux users: get packages from your distribution. Red Hat, Ubuntu, Debian, and others are pulling the stable patches into their update channels. If you manage embedded or IoT systems with custom Yocto or Buildroot images, merge the patch commit manually. The commit hash is available in the stable trees; for example, on the 6.12 branch, look for can: gw: cgwcsumcrc8rel(): fix retrieval of from/to indices.
If patching can’t happen today, apply these workarounds:
- Blacklist the
can-gwmodule:echo "blacklist can-gw" > /etc/modprobe.d/disable-can-gw.confand reboot ormodprobe -r can-gwif already loaded. - Audit and restrict
CAPNETADMIN. In Kubernetes, adjust Pod Security Standards; in Docker, never run containers with--cap-add=NETADMINunless necessary. On systemd‑based systems, confineCAPNETADMINto specific services viaCapabilityBoundingSet. - Monitor for crashes or KASAN reports mentioning
cgwcsumcrc8rel; they signal an active attack or a fragile unpatched system.
The Patch Landscape: Fixed Kernel Versions
Use this table to identify the minimum fixed kernel for your branch:
| Kernel Branch | Fixed Version or Later |
|---|---|
| 5.10 | 5.10.253 |
| 5.15 | 5.15.203 |
| 6.1 | 6.1.168 |
| 6.6 | 6.6.131 |
| 6.12 | 6.12.80 |
| 6.18 | 6.18.21 |
| 6.19 | 6.19.11 |
| 7.0 | Fixed in mainline |
If your kernel version is older than the threshold for its branch, you need to upgrade. Rolling‑release distributions (Arch, openSUSE Tumbleweed) should already have the fix in their latest kernels.
Workarounds if Patching Isn’t Immediate
For industrial or automotive systems that cannot be taken offline quickly, temporary mitigations are critical. Because exploitation requires CAPNETADMIN, focus on that capability. In containerized environments, a quick win is to run your application containers with a seccomp profile that denies socket system calls for CAN bus families (AFCAN). This won’t stop a determined attacker who already has admin privileges in the namespace, but it raises the bar.
On virtual machines in Azure or Hyper‑V, ensure your guest OS kernels are updated. Azure’s own Linux images lag slightly behind upstream; check the Azure Linux release page for your distribution. For IoT Edge devices, use Device Update for IoT Hub to deploy kernel updates at scale.
Note that WSL 2 does not allow direct CAN hardware access by default, but CAN virtual interfaces can be created. If you don’t need CAN functionality, remove the module altogether.
Looking Ahead
Microsoft will likely absorb the fix into future WSL kernel releases; watch the WSL GitHub repository for an announcement. In the broader ecosystem, this incident highlights how niche kernel subsystems can become cross‑platform liabilities when they’re dragged into environments like WSL. The CAPNET_ADMIN prerequisite keeps Internet‑wide exploitability low—Tenable’s EPSS score is just 0.00024—but for automotive and industrial facilities, the risk is tangible. Patch Tuesday is a Windows ritual; treat kernel CVE days the same way for your Linux boxes, even the ones hiding inside WSL.