CVE-2026-80707 can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer
An attacker can read uninitialized memory from the J1939 transport layer receive buffer, potentially exposing sensitive kernel data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80707?
CVE-2026-80707 is a high-severity vulnerability in Linux, published on 28 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer
Zero the allocated buffer in j1939_session_fresh_new() to ensure it contains no residual data.
While there is a potential performance impact if users allocate maximum sized ETP buffers, most real-world use cases are not noticeably affected since the maximum known buffer size is typically around 65K.
[mkl: add Message-ID]
Which versions are affected by CVE-2026-80707?
How do I fix CVE-2026-80707?
Apply the vendor's patch.
Is CVE-2026-80707 being exploited?
There is no known exploitation of CVE-2026-80707 in the wild and no public exploit code.
Sources
Also known as AZL-98108, BELL-CVE-2026-80707, DEBIAN-CVE-2026-80707, GHSA-7qjr-5mr5-8m2q, UBUNTU-CVE-2026-80707.