{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72119", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.906Z", "datePublished": "2026-08-15T05:52:58.479Z", "dateUpdated": "2026-08-19T16:36:13.917Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:36:13.917Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: extend bcm_tx_lock usage for data and timer updates\n\nStage new CAN frame content for an existing tx op into a kmalloc()'d\nbuffer and validate it there, mirroring the approach already used in\nbcm_rx_setup(). Only copy the validated data into op->frames while\nholding op->bcm_tx_lock, so bcm_can_tx() and bcm_tx_timeout_handler()\ncan no longer observe a partially updated or unvalidated frame.\n\nAdd a missing error path for memcpy_from_msg() when copying CAN frame\ndata from userspace.\n\nAlso move the kt_ival1/kt_ival2/ival1/ival2 updates in bcm_tx_setup()\nunder op->bcm_tx_lock, and read kt_ival1/kt_ival2/count under the same\nlock in bcm_tx_set_expiry() and bcm_tx_timeout_handler(), closing the\ntorn 64-bit ktime_t read on 32-bit platforms."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only through PF_CAN/CAN_BCM socket sendmsg() TX_SETUP updates racing hrtimer-driven bcm_can_tx(); it is not triggered by remote network services or CAN bus traffic alone.\nAC:L - The attacker controls both sides of the race by creating cyclic TX ops with STARTTIMER/SETTIMER and repeatedly issuing TX_SETUP while the softirq hrtimer fires, making the window reliably winnable without external timing luck.\nPR:L - bcm_sendmsg()/bcm_connect() enforce no capability checks; any local user with access to a CAN interface (including vcan created with CAP_NET_ADMIN inside an unprivileged user namespace) can open BCM sockets and drive TX_SETUP.\nUI:N - Exploitation requires only the attacker opening a BCM socket and sending TX_SETUP messages; no victim interaction such as mounting filesystems or opening files is needed.\nS:U - Impact is confined to kernel memory/state corruption and local privilege effects on the host running CAN BCM; it does not cross a VM, container, or IOMMU security boundary by itself.\nC:H - Racing updates can let bcm_can_tx() transmit partially updated or unvalidated frames (e.g., len>64) before bcm_tx_setup() rejects them, and many CAN driver xmit paths memcpy(cf->data, cf->len) trusting len, causing kernel out-of-bounds reads.\nI:H - Concurrent unsynchronized writes to op->frames, flags, count, and ktime_t timer fields corrupt shared in-kernel BCM state that directly feeds skb construction and driver transmission, providing attacker-influenced memory corruption primitives.\nA:H - Observing torn/unvalidated frames in bcm_can_tx() during active timers can trigger kernel WARN/Oops/panic via out-of-bounds accesses in CAN drivers, and torn ktime_t/count reads can disrupt cyclic transmission causing denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/can/bcm.c"], "versions": [{"version": "7595de7bc56e0e52b74e56c90f7e247bf626d628", "lessThan": "a538b072ee074c9b41b9d9c15a6861a963e30755", "status": "affected", "versionType": "git"}, {"version": "fbd8fdc2b218e979cfe422b139b8f74c12419d1f", "lessThan": "63422347b4c782f429748b2a09cd3cf3b77e6abd", "status": "affected", "versionType": "git"}, {"version": "2a437b86ac5a9893c902f30ef66815bf13587bf6", "lessThan": "37917e432e50b7de2b64230974380132a30f7270", "status": "affected", "versionType": "git"}, {"version": "76c84c3728178b2d38d5604e399dfe8b0752645e", "lessThan": "52f06e7603780de100233713ddaf971d422e10ef", "status": "affected", "versionType": "git"}, {"version": "cc55dd28c20a6611e30596019b3b2f636819a4c0", "lessThan": "972fd66bb08fdef1090abe43196ca8da07216d13", "status": "affected", "versionType": "git"}, {"version": "c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7", "lessThan": "bd46f55dec608daa44b45dcf3328517630ad8e40", "status": "affected", "versionType": "git"}, {"version": "c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7", "lessThan": "337f966c00662d81ad82cf5a4bbb150b2e32c0d4", "status": "affected", "versionType": "git"}, {"version": "c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7", "lessThan": "12ce799f7ab1e05bd8fbf79e46f403bfe5597ebc", "status": "affected", "versionType": "git"}, {"version": "8f1c022541bf5a923c8d6fa483112c15250f30a4", "status": "affected", "versionType": "git"}, {"version": "c4e8a172501e677ebd8ea9d9161d97dc4df56fbd", "status": "affected", "versionType": "git"}, {"version": "5.10.238", "lessThan": "5.10.265", "status": "affected", "versionType": "semver"}, {"version": "5.15.185", "lessThan": "5.15.216", "status": "affected", "versionType": "semver"}, {"version": "6.1.141", "lessThan": "6.1.183", "status": "affected", "versionType": "semver"}, {"version": "6.6.93", "lessThan": "6.6.148", "status": "affected", "versionType": "semver"}, {"version": "6.12.31", "lessThan": "6.12.101", "status": "affected", "versionType": "semver"}, {"version": "5.4.294", "lessThan": "5.5", "status": "affected", "versionType": "semver"}, {"version": "6.14.9", "lessThan": "6.15", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/can/bcm.c"], "versions": [{"version": "6.15", "status": "affected"}, {"version": "0", "lessThan": "6.15", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.265", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.148", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.101", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.238", "versionEndExcluding": "5.10.265"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.185", "versionEndExcluding": "5.15.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.141", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.93", "versionEndExcluding": "6.6.148"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.31", "versionEndExcluding": "6.12.101"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.18.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.294"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14.9"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a538b072ee074c9b41b9d9c15a6861a963e30755"}, {"url": "https://git.kernel.org/stable/c/63422347b4c782f429748b2a09cd3cf3b77e6abd"}, {"url": "https://git.kernel.org/stable/c/37917e432e50b7de2b64230974380132a30f7270"}, {"url": "https://git.kernel.org/stable/c/52f06e7603780de100233713ddaf971d422e10ef"}, {"url": "https://git.kernel.org/stable/c/972fd66bb08fdef1090abe43196ca8da07216d13"}, {"url": "https://git.kernel.org/stable/c/bd46f55dec608daa44b45dcf3328517630ad8e40"}, {"url": "https://git.kernel.org/stable/c/337f966c00662d81ad82cf5a4bbb150b2e32c0d4"}, {"url": "https://git.kernel.org/stable/c/12ce799f7ab1e05bd8fbf79e46f403bfe5597ebc"}], "title": "can: bcm: extend bcm_tx_lock usage for data and timer updates", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/can/bcm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a538b072ee074c9b41b9d9c15a6861a963e30755", "status": "affected", "version": "7595de7bc56e0e52b74e56c90f7e247bf626d628", "versionType": "git"}, {"lessThan": "63422347b4c782f429748b2a09cd3cf3b77e6abd", "status": "affected", "version": "fbd8fdc2b218e979cfe422b139b8f74c12419d1f", "versionType": "git"}, {"lessThan": "37917e432e50b7de2b64230974380132a30f7270", "status": "affected", "version": "2a437b86ac5a9893c902f30ef66815bf13587bf6", "versionType": "git"}, {"lessThan": "52f06e7603780de100233713ddaf971d422e10ef", "status": "affected", "version": "76c84c3728178b2d38d5604e399dfe8b0752645e", "versionType": "git"}, {"lessThan": "972fd66bb08fdef1090abe43196ca8da07216d13", "status": "affected", "version": "cc55dd28c20a6611e30596019b3b2f636819a4c0", "versionType": "git"}, {"lessThan": "bd46f55dec608daa44b45dcf3328517630ad8e40", "status": "affected", "version": "c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7", "versionType": "git"}, {"lessThan": "337f966c00662d81ad82cf5a4bbb150b2e32c0d4", "status": "affected", "version": "c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7", "versionType": "git"}, {"lessThan": "12ce799f7ab1e05bd8fbf79e46f403bfe5597ebc", "status": "affected", "version": "c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7", "versionType": "git"}, {"status": "affected", "version": "8f1c022541bf5a923c8d6fa483112c15250f30a4", "versionType": "git"}, {"status": "affected", "version": "c4e8a172501e677ebd8ea9d9161d97dc4df56fbd", "versionType": "git"}, {"lessThan": "5.10.265", "status": "affected", "version": "5.10.238", "versionType": "semver"}, {"lessThan": "5.15.216", "status": "affected", "version": "5.15.185", "versionType": "semver"}, {"lessThan": "6.1.183", "status": "affected", "version": "6.1.141", "versionType": "semver"}, {"lessThan": "6.6.148", "status": "affected", "version": "6.6.93", "versionType": "semver"}, {"lessThan": "6.12.101", "status": "affected", "version": "6.12.31", "versionType": "semver"}, {"lessThan": "5.5", "status": "affected", "version": "5.4.294", "versionType": "semver"}, {"lessThan": "6.15", "status": "affected", "version": "6.14.9", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/can/bcm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"lessThan": "6.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.265", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.216", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.148", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.101", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.42", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: extend bcm_tx_lock usage for data and timer updates\n\nStage new CAN frame content for an existing tx op into a kmalloc()'d\nbuffer and validate it there, mirroring the approach already used in\nbcm_rx_setup(). Only copy the validated data into op->frames while\nholding op->bcm_tx_lock, so bcm_can_tx() and bcm_tx_timeout_handler()\ncan no longer observe a partially updated or unvalidated frame.\n\nAdd a missing error path for memcpy_from_msg() when copying CAN frame\ndata from userspace.\n\nAlso move the kt_ival1/kt_ival2/ival1/ival2 updates in bcm_tx_setup()\nunder op->bcm_tx_lock, and read kt_ival1/kt_ival2/count under the same\nlock in bcm_tx_set_expiry() and bcm_tx_timeout_handler(), closing the\ntorn 64-bit ktime_t read on 32-bit platforms."}], "id": "CVE-2026-72119", "lastModified": "2026-08-19T17:20:58.903", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T06:21:26.363", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/12ce799f7ab1e05bd8fbf79e46f403bfe5597ebc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/337f966c00662d81ad82cf5a4bbb150b2e32c0d4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/37917e432e50b7de2b64230974380132a30f7270"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/52f06e7603780de100233713ddaf971d422e10ef"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/63422347b4c782f429748b2a09cd3cf3b77e6abd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/972fd66bb08fdef1090abe43196ca8da07216d13"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a538b072ee074c9b41b9d9c15a6861a963e30755"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bd46f55dec608daa44b45dcf3328517630ad8e40"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: can: bcm: extend bcm_tx_lock usage for data and timer updates", "id": "2516416", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516416"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-366", "details": ["A flaw was found in the Linux kernel's Controller Area Network (CAN) Broadcast Manager (BCM) module. This vulnerability arises from a race condition where CAN frame data and timer updates can be observed in a partially updated or unvalidated state due to insufficient locking. Additionally, a missing error handling path when copying CAN frame data from user space contributes to the issue. An attacker could potentially exploit this to cause data corruption or unexpected system behavior within the CAN BCM module."], "name": "CVE-2026-72119", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72119\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72119\nhttps://lore.kernel.org/linux-cve-announce/2026081528-CVE-2026-72119-6c97@gregkh/T"], "threat_severity": "Moderate"}