Executive brief
The Linux kernel contains a use-after-free vulnerability in the CAN BCM (Broadcast Manager) subsystem's timer handling. An attacker with local access could exploit this race condition to cause a system crash or potentially execute code, disrupting any system or application relying on CAN bus communication (common in automotive and industrial control systems).
Technical details
The vulnerability is a use-after-free (UAF) in the CAN BCM rx_op deallocation path. The root cause stems from a race condition between RCU callback execution and the high-resolution timer (thrtimer) re-arming in bcm_rx_update_and_send(). When bcm_delete_rx_op() schedules deallocation via call_rcu(), a concurrent RCU reader can race and re-arm thrtimer. Once the RCU grace period completes and bcm_op is freed, the subsequently firing thrtimer dereferences the deallocated memory. The fix defers timer cancellation and memory deallocation to a dedicated workqueue (bcm_wq) instead of executing in softirq context, eliminating the TOCTOU race and allowing safe hrtimer_cancel() execution. Additionally, socket references are held until deferred work completes to prevent premature socket teardown.
Affected products
- Linux Linux kernel affected versions prior to fix commit
Timeline
- 2026-08-15: disclosed