Executive brief
A race condition was discovered in the Linux kernel's CAN bus BCM (Broadcast Manager) module when processing incoming CAN frames simultaneously on multiple CPU cores. While not directly exploitable for privilege escalation or data theft, this race condition can cause incorrect frame counters and statistics to be reported, potentially impacting system monitoring and diagnostics of vehicle or industrial control systems using CAN interfaces.
Technical details
The vulnerability is a data race condition in the bcm_rx_handler() function of the CAN BCM module, detected by KCSAN (Kernel Concurrency Sanitizer). When two CAN frames are simultaneously received and processed by different CPUs, unsynchronized access to rx/tx statistics counters creates a race. The fix involves converting statistics counters to atomic long data types and protecting updates with dedicated bcm_rx_update_lock (rx path) and bcm_tx_lock (tx path) sections. The root cause stems from counter resets performed separately from statistics updates, allowing one CPU to reset a counter between another CPU's read and write operations. This is a correctness fix rather than a security patch; the impact is limited to inaccurate diagnostic counters visible in procfs.
Affected products
- Linux Linux kernel affected versions not specified in advisory
Timeline
- 2026-08-15: disclosed