Re: [BUG] drivers/net: out-of-bounds in pcan_usb_decode_buf()
From: Geert Uytterhoeven
Date: Sat Sep 05 2026 - 10:08:14 EST
Hi Co,
On Fri, 4 Sept 2026 at 23:17, co <co+5e2bcf11e7027510@xxxxxxx> wrote:
> We found a bug reachable in:
>
> path drivers/net/can/usb/peak_usb
> crash out-of-bounds in pcan_usb_decode_buf()
> commit 2f1baf1fc892 ("Merge tag 'trace-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace")
>
> Config, environment, the sanitizer report and a C reproducer follow.
>
> == Notes ===============================================================
> If you patch the bug based on our artifacts, a tag would be
> appreciated:
>
> Reported-by: co+5e2bcf11e7027510@xxxxxxx
>
> Everything in this mail is validated by the reproducer below.
>
> We also hold an LLM-generated root-cause analysis and a candidate
> patch. The patch passes an A/B test: the same reproducer panics the
> unpatched kernel and runs clean on the patched one. Neither has had
> human review, so both still require validation before you send or
> apply them. Available on:
>
> patch.diff https://bugs.sh/b/5e2bcf11e7027510/patch.diff
> report.md https://bugs.sh/b/5e2bcf11e7027510/report.md
>
> This is an open science project. The code and the full set of PoCs
> are not public at this moment, as we intend to disclose our findings
> in an ethical way.
>
> Happy to test patches. Complaints and suggestions about our work
> are welcome at:
>
> cedalion@xxxxxxx
Please read Documentation/process/submitting-patches.rst, especially
https://elixir.bootlin.com/linux/v7.2.2/source/Documentation/process/submitting-patches.rst#L928
Thanks a lot!
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@xxxxxxxxxxxxxx
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds