The vulnerability exists in Zephyr's SocketCAN implementation where the function zcan_sendto_ctx() uses a NET_ASSERT to validate the length of a user-supplied socketcan_frame buffer before it is dereferenced in socketcan_to_can_frame(). Since assertions are disabled in production builds, an attacker controlling the length parameter to the sendto syscall can provide a truncated frame. This results in socketcan_to_can_frame() reading beyond the buffer boundary, causing an out-of-bounds read. The impact includes potential denial-of-service due to crashes and information leakage of adjacent memory via transmitted frame contents.

This vulnerability can lead to denial-of-service conditions by crashing the system due to out-of-bounds memory reads. Additionally, because the parsed frame contents are transmitted on the network, there is a risk of leaking adjacent memory contents, which may expose sensitive information. The CVSS score of 6.1 reflects a medium severity with local attack vector, low attack complexity, and limited confidentiality impact but high availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when handling untrusted userspace inputs to the SocketCAN interface. Consider disabling or restricting access to the affected SocketCAN functionality if possible to reduce risk.