Executive brief
The Linux kernel's CAN Broadcast Manager (BCM) module had insufficient locking when updating CAN frame data and timer configuration during runtime. This allowed concurrent operations to observe partially updated or unvalidated frame content, and created race conditions on 32-bit systems where 64-bit timer values could be read mid-update. A local attacker with network access could exploit this to cause denial of service or trigger unintended frame transmission behavior.
Technical details
The vulnerability is a race condition in the CAN Broadcast Manager (BCM) subsystem of the Linux kernel (net/can/bcm.c). The root cause is insufficient use of bcm_tx_lock spinlock when updating CAN frame data and timer intervals. The vulnerable code allowed functions like bcm_can_tx() and bcm_tx_timeout_handler() to observe partially updated or unvalidated frames, and on 32-bit platforms, permitted torn reads of 64-bit ktime_t values during concurrent bcm_tx_setup() updates. The fix extends bcm_tx_lock coverage to protect all frame data copies from userspace, validates frames in a temporary buffer before copying under lock, and ensures timer interval reads are atomic. The vulnerability requires local access to a CAN socket but no elevated privileges. Patches are available in kernel commits 12ce799f7ab1e and 337f966c0066 and later stable releases.
Affected products
- Linux Linux kernel All versions (fixed in 6.10+ and backported to stable branches)
Timeline
- 2026-08-15: disclosed
- 2026-07-14: patched: Upstream commit 12ce799f7ab1e05bd8fbf79e46f403bfe5597ebc