diff --git a/drivers/can/ctucanfd_pci.c b/drivers/can/ctucanfd_pci.c
index 647a9bce493..62382c3cbbb 100644
--- a/drivers/can/ctucanfd_pci.c
+++ b/drivers/can/ctucanfd_pci.c
@@ -760,6 +760,14 @@ static void ctucanfd_chardev_receive(FAR struct ctucanfd_can_s *priv)
 
       buff[0] = ctucanfd_getreg(priv, CTUCANFD_RXDATA);
 
+      /* buff[0] populated the frame->fmt.rwcnt. Check before use. */
+
+      if (frame->fmt.rwcnt > sizeof(buff) / sizeof(buff[0]))
+        {
+          canerr("ERROR: CAN read/write count is too large.  Dropped\n");
+          return;
+        }
+
       /* Read the rest of data */
 
       for (i = 0; i < frame->fmt.rwcnt; i++)
@@ -1249,6 +1257,14 @@ static FAR netpkt_t *ctucanfd_sock_recv(FAR struct netdev_lowerhalf_s *dev)
 
   buff[0] = ctucanfd_getreg(priv, CTUCANFD_RXDATA);
 
+  /* buff[0] populated the frame->fmt.rwcnt. Check before use. */
+
+  if (frame->fmt.rwcnt > sizeof(buff) / sizeof(buff[0]))
+    {
+      canerr("ERROR: CAN read/write count is too large.  Dropped\n");
+      return NULL;
+    }
+
   /* Read the rest of data */
 
   for (i = 0; i < rxframe->fmt.rwcnt; i++)