CVE-2026-72114

Received Received - Intake

CAN Frame Length Validation Bypass in Linux Kernel

Publication date: 2026-08-15

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: can: bcm: validate frame length in bcm_rx_setup() for RTR replies bcm_tx_setup() validates cf->len against the CAN/CAN FD DLC limits before installing frames for TX_SETUP, but bcm_rx_setup() never did the same for the RTR-reply frame configured via RX_SETUP with RX_RTR_FRAME.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-19

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72114

EUVD

EUVD-2026-59072

Affected Vendors & Products

Vendor	Product	Version / Range
bcm	linux_kernel	*
bcm	bcm_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's CAN (Controller Area Network) BCM (Broadcast Manager) module. It involves improper validation of frame length in the bcm_rx_setup() function when handling RTR (Remote Transmission Request) replies. The function fails to check if the configured frame length exceeds CAN/CAN FD DLC (Data Length Code) limits, unlike the bcm_tx_setup() function which does perform this validation for TX_SETUP operations.

Detection Guidance

This vulnerability affects the CAN BCM protocol in the Linux kernel. Detection requires checking kernel logs for CAN-related errors or crashes. Monitor logs with 'dmesg | grep -i can' or 'journalctl -k | grep -i can'. If BCM-related errors appear, the system may be vulnerable.

Impact Analysis

This vulnerability could allow an attacker to send maliciously crafted CAN frames with invalid lengths, potentially causing system instability, crashes, or unexpected behavior in applications relying on the CAN BCM module. It may lead to denial-of-service conditions or unintended interactions with CAN devices.

Compliance Impact

The provided CVE data does not describe any direct impact on compliance with standards like GDPR or HIPAA. The vulnerability is specific to the Linux kernel's CAN bus module and involves frame length validation in the bcm_rx_setup() function for RTR replies. There is no indication of data exposure, privacy violations, or protected health information risks associated with this issue.

Mitigation Strategies

Apply the latest Linux kernel update to patch this vulnerability. If immediate patching is not possible, disable the CAN BCM module using 'sudo modprobe -r can_bcm' as a temporary workaround. Ensure CAN interfaces are not processing RTR frames until patched.

Hi! I’m here to help you understand CVE-2026-72114. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70