CVE-2026-72119

Received Received - Intake

BaseFortify

Publication date: 2026-08-15

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: can: bcm: extend bcm_tx_lock usage for data and timer updates Stage new CAN frame content for an existing tx op into a kmalloc()'d buffer and validate it there, mirroring the approach already used in bcm_rx_setup(). Only copy the validated data into op->frames while holding op->bcm_tx_lock, so bcm_can_tx() and bcm_tx_timeout_handler() can no longer observe a partially updated or unvalidated frame. Add a missing error path for memcpy_from_msg() when copying CAN frame data from userspace. Also move the kt_ival1/kt_ival2/ival1/ival2 updates in bcm_tx_setup() under op->bcm_tx_lock, and read kt_ival1/kt_ival2/count under the same lock in bcm_tx_set_expiry() and bcm_tx_timeout_handler(), closing the torn 64-bit ktime_t read on 32-bit platforms.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-19

Generated

2026-10-14

AI Q&A

2026-08-15

EPSS Evaluated

2026-10-13

NVD

CVE-2026-72119

EUVD

EUVD-2026-58877

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	7595de7bc56e0e52b74e56c90f7e247bf626d628
Linux	Linux	fbd8fdc2b218e979cfe422b139b8f74c12419d1f
Linux	Linux	2a437b86ac5a9893c902f30ef66815bf13587bf6
Linux	Linux	76c84c3728178b2d38d5604e399dfe8b0752645e
Linux	Linux	cc55dd28c20a6611e30596019b3b2f636819a4c0
Linux	Linux	c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7
Linux	Linux	c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7
Linux	Linux	c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7
Linux	Linux	8f1c022541bf5a923c8d6fa483112c15250f30a4
Linux	Linux	c4e8a172501e677ebd8ea9d9161d97dc4df56fbd
Linux	Linux	5.10.238
Linux	Linux	5.15.185
Linux	Linux	6.1.141
Linux	Linux	6.6.93
Linux	Linux	6.12.31
Linux	Linux	5.4.294
Linux	Linux	6.14.9
Linux	Linux	6.15

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a race condition in the CAN BCM protocol implementation. It allows for potential corruption of CAN frame data during transmission by not properly synchronizing updates between the kernel and userspace. The issue arises when frame data is staged in a temporary buffer without proper locking, leading to possible inconsistencies.

Detection Guidance

This vulnerability is specific to the Linux kernel's CAN bus module (bcm). Detection requires checking kernel logs for CAN-related errors or kernel panics. Commands like dmesg | grep -i can or journalctl -k | grep -i can may help identify issues. Ensure your kernel version is updated to a patched release.

Impact Analysis

This vulnerability could allow an attacker with local access to corrupt CAN frame data, potentially causing system instability or unexpected behavior in applications relying on CAN communication. It may lead to data corruption or denial of service in systems using CAN protocols.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel CAN bus driver issue involving frame validation and locking mechanisms, not data privacy or security controls relevant to these regulations.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate patching is not possible, consider disabling the CAN BCM module via kernel parameters (e.g., blacklisting the can-bcm module) as a temporary workaround.

Hi! I’m here to help you understand CVE-2026-72119. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70