CVE-2026-72119: can: bcm: extend bcm_tx_lock usage for data and timer updates

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-15 · updated 2026-10-16

Description

In the Linux kernel, the following vulnerability has been resolved: can: bcm: extend bcm_tx_lock usage for data and timer updates Stage new CAN frame content for an existing tx op into a kmalloc()'d buffer and validate it there, mirroring the approach already used in bcm_rx_setup(). Only copy the validated data into op->frames while holding op->bcm_tx_lock, so bcm_can_tx() and bcm_tx_timeout_handler() can no longer observe a partially updated or unvalidated frame. Add a missing error path for memcpy_from_msg() when copying CAN frame data from userspace. Also move the kt_ival1/kt_ival2/ival1/ival2 updates in bcm_tx_setup() under op->bcm_tx_lock, and read kt_ival1/kt_ival2/count under the same lock in bcm_tx_set_expiry() and bcm_tx_timeout_handler(), closing the torn 64-bit ktime_t read on 32-bit platforms.

Affected products

Linux kernel: from 5.10.238 before 5.10.265; from 5.15.185 before 5.15.216; from 6.1.141 before 6.1.183; from 6.6.93 before 6.6.148; from 6.12.31 before 6.12.101; from 5.4.294 before 5.5 — fixed in 5.10.265, 5.15.216, 5.5, 6.1.183, 6.12.101, 6.15

How to fix

Upgrade to a fixed version: Linux kernel 5.10.265, 5.15.216, 5.5, 6.1.183. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-72119 or the next vulnerability affects your stack