{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72114", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.906Z", "datePublished": "2026-08-15T05:52:54.750Z", "dateUpdated": "2026-08-19T16:36:00.857Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:36:00.857Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: validate frame length in bcm_rx_setup() for RTR replies\n\nbcm_tx_setup() validates cf->len against the CAN/CAN FD DLC limits\nbefore installing frames for TX_SETUP, but bcm_rx_setup() never did\nthe same for the RTR-reply frame configured via RX_SETUP with\nRX_RTR_FRAME."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The missing validation is in bcm_rx_setup(), reached only via local PF_CAN SOCK_DGRAM CAN_BCM syscalls (socket/connect/sendmsg RX_SETUP with RX_RTR_FRAME); it is not triggered by remote IP services or by CAN bus traffic alone.\nAC:L - An attacker reliably installs a malformed RTR-reply frame with a single RX_SETUP sendmsg and can trigger bcm_can_tx() by sending or waiting for a matching RTR on the bound interface, with no races or layout dependencies beyond their control.\nPR:L - can_create(), bcm_connect(), and bcm_sendmsg() perform no capability checks; any local user with access to a CAN interface (including vcan created with CAP_NET_ADMIN in an unprivileged user namespace) can open BCM sockets and program RX_SETUP RTR replies.\nUI:N - Exploitation requires only the attacker opening a BCM socket and sending RX_SETUP messages; no victim interaction such as mounting filesystems or opening files is needed once local CAN access exists.\nS:U - Impact is kernel memory corruption and unauthorized CAN frame transmission within the same host security domain; it does not cross VM, container, or IOMMU boundaries even when frames reach an adjacent vehicle or industrial CAN segment.\nC:H - Unvalidated cf->len values are stored in op->frames and later passed to bcm_can_tx()/can_send(); many CAN driver ndo_start_xmit paths memcpy(cf->data, cf->len) trusting len, enabling out-of-bounds kernel reads when invalid lengths bypass or race skb validation.\nI:H - Attacker-controlled len in the RTR-reply frame can drive out-of-bounds memcpy writes in CAN USB/SPI/hardware xmit paths and inject attacker-crafted frame payloads onto safety-critical automotive, factory, or embedded CAN buses when RTR requests are answered.\nA:H - Out-of-bounds accesses in CAN driver transmit paths from trusted-but-invalid len values can cause kernel WARN/Oops/panic on hardened builds, and repeated malformed RTR-reply transmission attempts can wedge TX queues or disrupt CAN service on affected systems."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/can/bcm.c"], "versions": [{"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "cc1f9569f1c1adf74fa69d6f716a31b58a2fc6ce", "status": "affected", "versionType": "git"}, {"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "204f2b232717bc470ddb9e1da1d27dd9c6ef0caa", "status": "affected", "versionType": "git"}, {"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "e061624c0a86c3c26a2bf017e432fbc93ad68f3a", "status": "affected", "versionType": "git"}, {"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "7d966cdee006911d3957e1a4e72cb93c39cd8c1e", "status": "affected", "versionType": "git"}, {"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "1b475c0c72f44622a320a4386ce9e76f85e69bc7", "status": "affected", "versionType": "git"}, {"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "deb6a697cce3f021e731df543597f37a5e54caab", "status": "affected", "versionType": "git"}, {"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "59bfddea64159594feb62ef11b7d7a33c8ee3783", "status": "affected", "versionType": "git"}, {"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "62ec41f364648be79d54d94d0d240ee326948afd", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/can/bcm.c"], "versions": [{"version": "2.6.25", "status": "affected"}, {"version": "0", "lessThan": "2.6.25", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.265", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.148", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.101", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "5.10.265"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "5.15.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "6.6.148"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "6.12.101"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "6.18.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/cc1f9569f1c1adf74fa69d6f716a31b58a2fc6ce"}, {"url": "https://git.kernel.org/stable/c/204f2b232717bc470ddb9e1da1d27dd9c6ef0caa"}, {"url": "https://git.kernel.org/stable/c/e061624c0a86c3c26a2bf017e432fbc93ad68f3a"}, {"url": "https://git.kernel.org/stable/c/7d966cdee006911d3957e1a4e72cb93c39cd8c1e"}, {"url": "https://git.kernel.org/stable/c/1b475c0c72f44622a320a4386ce9e76f85e69bc7"}, {"url": "https://git.kernel.org/stable/c/deb6a697cce3f021e731df543597f37a5e54caab"}, {"url": "https://git.kernel.org/stable/c/59bfddea64159594feb62ef11b7d7a33c8ee3783"}, {"url": "https://git.kernel.org/stable/c/62ec41f364648be79d54d94d0d240ee326948afd"}], "title": "can: bcm: validate frame length in bcm_rx_setup() for RTR replies", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/can/bcm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "cc1f9569f1c1adf74fa69d6f716a31b58a2fc6ce", "status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "versionType": "git"}, {"lessThan": "204f2b232717bc470ddb9e1da1d27dd9c6ef0caa", "status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "versionType": "git"}, {"lessThan": "e061624c0a86c3c26a2bf017e432fbc93ad68f3a", "status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "versionType": "git"}, {"lessThan": "7d966cdee006911d3957e1a4e72cb93c39cd8c1e", "status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "versionType": "git"}, {"lessThan": "1b475c0c72f44622a320a4386ce9e76f85e69bc7", "status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "versionType": "git"}, {"lessThan": "deb6a697cce3f021e731df543597f37a5e54caab", "status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "versionType": "git"}, {"lessThan": "59bfddea64159594feb62ef11b7d7a33c8ee3783", "status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "versionType": "git"}, {"lessThan": "62ec41f364648be79d54d94d0d240ee326948afd", "status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/can/bcm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.25"}, {"lessThan": "2.6.25", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.265", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.216", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.148", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.101", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.42", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: validate frame length in bcm_rx_setup() for RTR replies\n\nbcm_tx_setup() validates cf->len against the CAN/CAN FD DLC limits\nbefore installing frames for TX_SETUP, but bcm_rx_setup() never did\nthe same for the RTR-reply frame configured via RX_SETUP with\nRX_RTR_FRAME."}], "id": "CVE-2026-72114", "lastModified": "2026-08-19T17:20:57.650", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T06:21:25.803", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1b475c0c72f44622a320a4386ce9e76f85e69bc7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/204f2b232717bc470ddb9e1da1d27dd9c6ef0caa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/59bfddea64159594feb62ef11b7d7a33c8ee3783"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/62ec41f364648be79d54d94d0d240ee326948afd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7d966cdee006911d3957e1a4e72cb93c39cd8c1e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cc1f9569f1c1adf74fa69d6f716a31b58a2fc6ce"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/deb6a697cce3f021e731df543597f37a5e54caab"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e061624c0a86c3c26a2bf017e432fbc93ad68f3a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: can: bcm: validate frame length in bcm_rx_setup() for RTR replies", "id": "2516660", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516660"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-130", "details": ["A flaw was found in the Linux kernel's Controller Area Network (CAN) Broadcom (bcm) driver. This vulnerability arises from insufficient validation of frame lengths when processing Remote Transmission Request (RTR) replies. An attacker could exploit this by sending a specially crafted RTR reply, which may lead to a system crash or other unpredictable system behavior."], "name": "CVE-2026-72114", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72114\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72114\nhttps://lore.kernel.org/linux-cve-announce/2026081527-CVE-2026-72114-39ad@gregkh/T"], "threat_severity": "Moderate"}