Executive brief
The Linux kernel's CAN (Controller Area Network) broadcast manager module contains a race condition in socket binding that can cause network frames to be incorrectly routed to unintended interfaces. Additionally, failed device binding operations may silently report success, leaving broken receive operations registered in the system. This could result in messages being processed by the wrong CAN interface or critical receive operations silently failing.
Technical details
The vulnerability is a data race in the CAN broadcast manager (bcm) module in net/can/bcm.c. The bcm_sendmsg() function reads bo->ifindex and checks bo->bound without holding a lock, while bcm_notify(), bcm_connect(), and bcm_release() mutate these fields under lock_sock(). This unordered locking allows a concurrent bcm_notify() (triggered by device unregister) or bcm_connect() (concurrent bind) to create an inconsistent state where bo->bound remains 1 while bo->ifindex becomes 0, causing the socket to inadvertently match any interface instead of its intended specific interface. Additionally, bcm_rx_setup() silently returns success when a target device disappears during setup instead of reporting -ENODEV, leaving broken receive operations registered. The fix moves the ifindex read into the locked section and adds proper error reporting in bcm_rx_setup().
Affected products
- Linux Linux kernel multiple versions prior to patch
Timeline
- 2026-08-15: disclosed
- 2026-07-24: patched: Fix committed to stable kernel branches