Executive brief
The Linux kernel's CAN bus frame broadcaster module has a race condition where concurrent operations can corrupt timer and filter settings. An attacker with local access to CAN network interfaces could trigger simultaneous updates to cause memory corruption, denial of service, or potentially execute code with kernel privileges.
Technical details
The vulnerability is a race condition (TOCTOU) in the Linux kernel's CAN BCM (Broadcast Manager) module affecting bcm_rx_setup() and concurrent RX handlers. The root cause is that timer values (ival1/ival2/kt_ival1/kt_ival2/kt_lastmsg) and filter metadata (nframes/flags/frames/last_frames) are updated without proper locking, allowing bcm_rx_handler(), bcm_rx_timeout_handler(), or bcm_rx_thr_handler() to read partially updated state. Additionally, an RTR flag normalization step occurs unprotected after frame installation, creating a window where stale frames with incorrect flags can be transmitted. The fix introduces per-operation bcm_rx_update_lock spinlock protection for these critical sections and ensures frame consistency atomically. Attack vector requires local access to CAN interfaces and ability to trigger concurrent frame reception and configuration updates.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-08-15: disclosed