The vulnerability exists in Zephyr's SocketCAN code where the length of a socketcan_frame buffer is checked only by a NET_ASSERT in zcan_sendto_ctx(). In production builds, assertions are disabled, so an attacker controlling the length parameter to the sendto syscall can provide a truncated frame. This causes socketcan_to_can_frame() to dereference memory beyond the buffer end, resulting in an out-of-bounds read. The impact includes potential denial-of-service due to crashes and leakage of adjacent memory through network transmission of the malformed frame.

An attacker with limited privileges (local user with permission to send socketcan frames) can cause the system to crash (denial-of-service) or leak adjacent memory contents over the network. The confidentiality of memory adjacent to the buffer may be compromised. There is no indication of code execution or privilege escalation. The CVSS score is 6.1 (medium severity), reflecting local attack vector with low complexity and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should restrict access to the sendto syscall for socketcan frames to trusted users only. Monitoring for abnormal socketcan frame lengths may help detect exploitation attempts. Avoid running production builds with assertions disabled if possible, or apply any vendor-provided mitigations once available.