CVE-2026-72119can: bcm: extend bcm_tx_lock usage for data and timer updates
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: can: bcm: extend bcm_tx_lock usage for data and timer updates Stage new CAN frame content for an existing tx op into a kmalloc()'d buffer and validate it there, mirroring the approach already used in bcm_rx_setup(). Only copy the validated data into op->frames while holding op->bcm_tx_lock, so bcm_can_tx() and bcm_tx_timeout_handler() can no longer observe a partially updated or unvalidated frame. Add a missing error path for memcpy_from_msg() when copying CAN frame data from userspace. Also move the kt_ival1/kt_ival2/ival1/ival2 updates in bcm_tx_setup() under op->bcm_tx_lock, and read kt_ival1/kt_ival2/count under the same lock in bcm_tx_set_expiry() and bcm_tx_timeout_handler(), closing the torn 64-bit ktime_t read on 32-bit platforms.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 7595de7bc56e0e52b74e56c90f7e247bf626d628 before a538b072ee074c9b41b9d9c15a6861a963e30755; from fbd8fdc2b218e979cfe422b139b8f74c12419d1f before 63422347b4c782f429748b2a09cd3cf3b77e6abd; from 2a437b86ac5a9893c902f30ef66815bf13587bf6 before 37917e432e50b7de2b64230974380132a30f7270; 76c84c3728178b2d38d5604e399dfe8b0752645e builds before 52f06e7603780de100233713ddaf971d422e10ef; from cc55dd28c20a6611e30596019b3b2f636819a4c0 before 972fd66bb08fdef1090abe43196ca8da07216d13; from c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 before bd46f55dec608daa44b45dcf3328517630ad8e40; from c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 before 337f966c00662d81ad82cf5a4bbb150b2e32c0d4; from c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 before 12ce799f7ab1e05bd8fbf79e46f403bfe5597ebc; and 9 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/a538b072ee074c9b41b9d9c15a6861a963e30755
- https://git.kernel.org/stable/c/63422347b4c782f429748b2a09cd3cf3b77e6abd
- https://git.kernel.org/stable/c/37917e432e50b7de2b64230974380132a30f7270
- https://git.kernel.org/stable/c/52f06e7603780de100233713ddaf971d422e10ef
- https://git.kernel.org/stable/c/972fd66bb08fdef1090abe43196ca8da07216d13
- https://git.kernel.org/stable/c/bd46f55dec608daa44b45dcf3328517630ad8e40
- https://git.kernel.org/stable/c/337f966c00662d81ad82cf5a4bbb150b2e32c0d4
- https://git.kernel.org/stable/c/12ce799f7ab1e05bd8fbf79e46f403bfe5597ebc
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.